CVE-2019-5517

Severity: medium (CVSS 6.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-04-15 · updated 2026-06-17
Weakness: CWE-125

Description

VMware ESXi (6.7 before ESXi670-201904101-SG and 6.5 before ESXi650-201903001), Workstation (15.x before 15.0.3 and 14.x before 14.1.6), Fusion (11.x before 11.0.3 and 10.x before 10.1.6) contain multiple out-of-bounds read vulnerabilities in the shader translator. Exploitation of these issues requires an attacker to have access to a virtual machine with 3D graphics enabled. Successful exploitation of these issues may lead to information disclosure or may allow attackers with normal user privileges to create a denial-of-service condition on their own VM. The workaround for these issues involves disabling the 3D-acceleration feature. This feature is not enabled by default on ESXi and is enabled by default on Workstation and Fusion.

Affected products

VMware ESXi: 6.5-650-201701001, 6.5-650-201703001, 6.5-650-201703002, 6.5-650-201704001, 6.5-650-201707101, 6.5-650-201707102 (+108); 6.5, 6.7
VMware Fusion: from 10.0.0 before 10.1.6; from 11.0.0 before 11.0.3 — fixed in 10.1.6, 11.0.3
VMware Workstation: from 14.0.0 before 14.1.6; from 15.0.0 before 15.0.3 — fixed in 14.1.6, 15.0.3
VMware ESXi: 6.7 before ESXi670-201904101-SG, 6.5 before ESXi650-201903001
VMware Fusion: 11.x before 11.0.3, 10.x before 10.1.6
VMware Workstation: 15.x before 15.0.3, 14.x before 14.1.6

How to fix

Upgrade to a fixed version: VMware Fusion 10.1.6, 11.0.3; VMware Workstation 14.1.6, 15.0.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-5517 or the next vulnerability affects your stack