CVE-2019-5520

Severity: medium (CVSS 5.9 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-04-15 · updated 2026-06-17
Weakness: CWE-125

Description

VMware ESXi (6.7 before ESXi670-201904101-SG and 6.5 before ESXi650-201903001), Workstation (15.x before 15.0.3 and 14.x before 14.1.6), Fusion (11.x before 11.0.3 and 10.x before 10.1.6) updates address an out-of-bounds read vulnerability. Exploitation of this issue requires an attacker to have access to a virtual machine with 3D graphics enabled. Successful exploitation of this issue may lead to information disclosure.The workaround for this issue involves disabling the 3D-acceleration feature. This feature is not enabled by default on ESXi and is enabled by default on Workstation and Fusion.

Affected products

VMware ESXi: 6.5-650-201701001, 6.5-650-201703001, 6.5-650-201703002, 6.5-650-201704001, 6.5-650-201707101, 6.5-650-201707102 (+108); 6.5, 6.7
VMware Fusion: from 10.0.0 before 10.1.6; from 11.0.0 before 11.0.3 — fixed in 10.1.6, 11.0.3
VMware Workstation: from 14.0.0 before 14.1.6; from 15.0.0 before 15.0.3 — fixed in 14.1.6, 15.0.3
VMware ESXi: 6.7 before ESXi670-201904101-SG, 6.5 before ESXi650-201903001
VMware Fusion: 11.x before 11.0.3, 10.x before 10.1.6
VMware Workstation: 15.x before 15.0.3, 14.x before 14.1.6

How to fix

Upgrade to a fixed version: VMware Fusion 10.1.6, 11.0.3; VMware Workstation 14.1.6, 15.0.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-5520 or the next vulnerability affects your stack