CVE-2020-3979

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-09-18 · updated 2026-06-17
Weakness: CWE-427

Description

InstallBuilder for Qt Windows (versions prior to 20.7.0) installers look for plugins at a predictable location at initialization time, writable by non-admin users. While those plugins are not required, they are loaded if present, which could allow an attacker to plant a malicious library which could result in code execution with the security scope of the installer.

Affected products

VMware InstallBuilder: before 20.7.0 — fixed in 20.7.0

How to fix

Upgrade to a fixed version: VMware InstallBuilder 20.7.0. Check the vendor advisory for mitigations.

References

https://blog.installbuilder.com/2020/08/updates-and-bug-fixes-with-version-2070.html
https://blog.installbuilder.com/2020/08/updates-and-bug-fixes-with-version-2070.html

Get alerted when CVE-2020-3979 or the next vulnerability affects your stack