CVE-2016-7461

CVE-2016-7461 describes a critical vulnerability in VMware Workstation Pro, Workstation Player, and Fusion/Fusion Pro versions 12.x and 8.x respectively, where the drag-and-drop function allows a guest OS user to execute arbitrary code or cause a denial of service on the host OS. This vulnerability carries a high CVSS score of 8.8, indicating a severe risk with local attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. While no public exploit code (Metasploit, Nuclei, ExploitDB) is readily available and it's not listed in CISA's KEV catalog, the vulnerability has garnered some community discussion and media coverage, suggesting it is known within security circles. Its FAUCET Risk Score of 67/100 further emphasizes its significant risk despite the lack of confirmed active exploitation.