vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2019-5520

N/A
Published: April 15, 2019 at 05:12 PM UTC
Updated: June 17, 2026 at 02:37 AM UTC
3 products affected across 1 vendorWorkstationESXiFusion

Using ESXi by VMware?

Get instant alerts when new vulnerabilities affect ESXi - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
N/A
Exploit prediction
EPSS 1%

Description

VMware ESXi (6.7 before ESXi670-201904101-SG and 6.5 before ESXi650-201903001), Workstation (15.x before 15.0.3 and 14.x before 14.1.6), Fusion (11.x before 11.0.3 and 10.x before 10.1.6) updates address an out-of-bounds read vulnerability. Exploitation of this issue requires an attacker to have access to a virtual machine with 3D graphics enabled. Successful exploitation of this issue may lead to information disclosure.The workaround for this issue involves disabling the 3D-acceleration feature. This feature is not enabled by default on ESXi and is enabled by default on Workstation and Fusion.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

ESXi· VMware
95%
6.56.5 650-2017010016.5 650-2017030016.5 650-2017030026.5 650-2017040016.5 650-2017071016.5 650-2017071026.5 650-2017071036.5 650-2017072016.5 650-2017072026.5 650-2017072036.5 650-2017072046.5 650-2017072056.5 650-2017072066.5 650-2017072076.5 650-2017072086.5 650-2017072096.5 650-2017072106.5 650-2017072116.5 650-2017072126.5 650-2017072136.5 650-2017072146.5 650-2017072156.5 650-2017072166.5 650-2017072176.5 650-2017072186.5 650-2017072196.5 650-2017072206.5 650-2017072216.5 650-2017100016.5 650-2017120016.5 650-2018030016.5 650-2018060016.5 650-2018080016.5 650-2018100016.5 650-2018100026.5 650-2018110016.5 650-2018110026.5 650-2018113016.5 650-2019010016.5 before ESXi650-2019030016.76.7 670-2018060016.7 670-2018070016.7 670-2018080016.7 670-2018100016.7 670-2018101016.7 670-2018101026.7 670-2018101036.7 670-2018102016.7 670-2018102026.7 670-2018102036.7 670-2018102046.7 670-2018102056.7 670-2018102066.7 670-2018102076.7 670-2018102086.7 670-2018102096.7 670-2018102106.7 670-2018102116.7 670-2018102126.7 670-2018102136.7 670-2018102146.7 670-2018102156.7 670-2018102166.7 670-2018102176.7 670-2018102186.7 670-2018102196.7 670-2018102206.7 670-2018102216.7 670-2018102226.7 670-2018102236.7 670-2018102246.7 670-2018102256.7 670-2018102266.7 670-2018102276.7 670-2018102286.7 670-2018102296.7 670-2018102306.7 670-2018102316.7 670-2018102326.7 670-2018102336.7 670-2018102346.7 670-2018110016.7 670-2019010016.7 670-2019014016.7 670-2019014026.7 670-2019014036.7 670-2019042016.7 670-2019042026.7 670-2019042036.7 670-2019042046.7 670-2019042056.7 670-2019042066.7 670-2019042076.7 670-2019042086.7 670-2019042096.7 670-2019042106.7 670-2019042116.7 670-2019042126.7 670-2019042136.7 670-2019042146.7 670-2019042156.7 670-2019042166.7 670-2019042176.7 670-2019042186.7 670-2019042196.7 670-2019042206.7 670-2019042216.7 670-2019042226.7 670-2019042236.7 670-2019042246.7 670-2019042256.7 670-2019042266.7 670-2019042276.7 670-2019042286.7 670-2019042296.7 before ESXi670-201904101-SG
Fusion· VMware
95%
10 ≤ v < 10.1.610.0.0 ≤ v < 10.1.611 ≤ v < 11.0.311.0.0 ≤ v < 11.0.3
Affected range stops below 10.1.6, so it looks safe — our inference, not a vendor statement
Affected range stops below 11.0.3, so it looks safe — our inference, not a vendor statement
Workstation· VMware
95%
14 ≤ v < 14.1.614.0.0 ≤ v < 14.1.615 ≤ v < 15.0.315.0.0 ≤ v < 15.0.3
Affected range stops below 14.1.6, so it looks safe — our inference, not a vendor statement
Affected range stops below 15.0.3, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (2)

x_refsource_CONFIRMPatchVendor Advisory
Source: [email protected]
https://www.vmware.com/security/advisories/VMSA-2019-0006.html
x_refsource_MISC
Source: [email protected]
https://www.zerodayinitiative.com/advisories/ZDI-19-369/

CVSS

4.3MEDIUM[email protected]
Confidentiality
PARTIAL
Integrity
NONE
Availability
NONE
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-125

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card