CVE-2020-3999

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-12-21 · updated 2026-06-17
Weakness: CWE-20

Description

VMware ESXi (7.0 prior to ESXi70U1c-17325551), VMware Workstation (16.x prior to 16.0 and 15.x prior to 15.5.7), VMware Fusion (12.x prior to 12.0 and 11.x prior to 11.5.7) and VMware Cloud Foundation contain a denial of service vulnerability due to improper input validation in GuestInfo. A malicious actor with normal user privilege access to a virtual machine can crash the virtual machine's vmx process leading to a denial of service condition.

Affected products

VMware ESXi: 7.0-beta, 7.0-update_1, 7.0-update_1a, 7.0-update_1b; 7.0
VMware Fusion: from 11.5.0 before 11.5.7 — fixed in 11.5.7
VMware Workstation: from 15.0.0 before 15.5.7 — fixed in 15.5.7
VMware ESXi, VMware Workstation,VMware Fusion and VMware Cloud Foundation: from VMware ESXi (7.0 prior through ESXi70U1c-17325551), VMware Workstation (16.x prior to 16.0 and 15.x prior to 15.5.7)and VMware Fusion (12.x prior to 12.0 and 11.x prior to 11.5.7)

How to fix

Upgrade to a fixed version: VMware Fusion 11.5.7; VMware Workstation 15.5.7. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-3999 or the next vulnerability affects your stack