VMware Workstation 17.6.3 - vmnat.exe Crashes Due to NULL Pointer (Possible Zscaler Conflict)

[josemrivas]

Hi everyone,

I'm encountering a critical issue with VMware Workstation 17.6.3 (build-24583834) on a Windows host. The VMware NAT Service (vmnat.exe) is frequently crashing due to NULL pointer dereference errors, severely impacting the stability of my virtual networking.

In my setup:

• Guest OS: Ubuntu (latest updates applied)

• Host OS: Windows 10/11 (up to date)

• Networking mode: NAT

• Security software: Zscaler is installed and actively running inside the guest OS

The issue seems to be related to NAT networking, as the crashes are persistent and only occur while the guest is running and using network resources. The vmnat.exe crashes are visible in the Windows Event Viewer as application errors referencing access violations due to NULL pointers.

I've tried:

• Restarting the NAT service manually

• Reinstalling VMware Workstation

• Ensuring VMware Network Services are set to auto-start

But the problem persists.

Has anyone else experienced something similar, especially when using Zscaler or similar security stacks in the guest OS? Any workarounds or insights would be greatly appreciated.

Thanks in advance!

[Shruti Chavadi]

Hi @josemrivas,

Can you please share the support bundle for the issue.

Thanks.

[josemrivas]

Hi,

I can't get the support bundle at this moment, but I saved this info from the host:

Translated into english here:

Application name with errors: vmnat.exe, version: 17.6.3.61826, timestamp: 0x67b70923
Module name with errors: vmnat.exe, version: 17.6.3. 61826, timestamp: 0x67b70923
Exception code: 0xc0000005
Error offset: 0x0000ecb8
Process identifier with errors: 0x52b4
Application start time with errors: 0x01dbbf35f36ef86d
Application path with errors: C:\Windows\SysWOW64\vmnat. exe
Path of the module with errors: C:\Windows\SysWOW64\vmnat.exe
Report identifier: 159e15d4-9fad-4b70-b3c7-54c130930d2d
Full name of the package with errors: 
Relative application identifier of the package with errors:

The exception code 0xC0000005 indicates an Access Violation, and it can be related to Data Execution Prevention (DEP) in Windows. It could be deactivated, but it would not be a good idea.

Thanks