CVE-2019-5524

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-04-02 · updated 2026-06-17
Weakness: CWE-787

Description

VMware Workstation (14.x before 14.1.6) and Fusion (10.x before 10.1.6) contain an out-of-bounds write vulnerability in the e1000 virtual network adapter. This issue may allow a guest to execute code on the host.

Affected products

VMware Fusion: from 10.0.0 before 10.1.6 — fixed in 10.1.6
VMware Workstation: from 14.0.0 before 14.1.6 — fixed in 14.1.6
VMware Workstation, VMware Fusion: Workstation (14.x before 14.1.6), Fusion (10.x before 10.1.6)

How to fix

Upgrade to a fixed version: VMware Fusion 10.1.6; VMware Workstation 14.1.6. Check the vendor advisory for mitigations.

References

http://packetstormsecurity.com/files/152290/VMware-Security-Advisory-2019-0005.html
http://www.securityfocus.com/bid/107635
https://www.vmware.com/security/advisories/VMSA-2019-0005.html
http://packetstormsecurity.com/files/152290/VMware-Security-Advisory-2019-0005.html
http://www.securityfocus.com/bid/107635
https://www.vmware.com/security/advisories/VMSA-2019-0005.html

Get alerted when CVE-2019-5524 or the next vulnerability affects your stack