CVE-2019-5525

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-06-06 · updated 2026-06-17
Weakness: CWE-416

Description

VMware Workstation (15.x before 15.1.0) contains a use-after-free vulnerability in the Advanced Linux Sound Architecture (ALSA) backend. A malicious user with normal user privileges on the guest machine may exploit this issue in conjunction with other issues to execute code on the Linux host where Workstation is installed.

Affected products

VMware Workstation: from 15.0.0 before 15.1.0 — fixed in 15.1.0
VMware Workstation: VMware Workstation (15.x before 15.1.0)

How to fix

Upgrade to a fixed version: VMware Workstation 15.1.0. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/108674
https://www.vmware.com/security/advisories/VMSA-2019-0009.html
http://www.securityfocus.com/bid/108674
https://www.vmware.com/security/advisories/VMSA-2019-0009.html

Get alerted when CVE-2019-5525 or the next vulnerability affects your stack