CVE-2020-3999

MEDIUM

6.5

CVSS Score

Published: December 21, 2020 at 03:14 PM UTC

Updated: June 17, 2026 at 03:19 AM UTC

4 products affected across 1 vendorWorkstationESXiFusion· also runs on 1 platform

Using VMware ESXi, VMware Workstation,VMware Fusion and VMware Cloud Foundation by N/A?

Get instant alerts when new vulnerabilities affect VMware ESXi, VMware Workstation,VMware Fusion and VMware Cloud Foundation - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM6.5

Exploit prediction

EPSS 0.4%

Description

VMware ESXi (7.0 prior to ESXi70U1c-17325551), VMware Workstation (16.x prior to 16.0 and 15.x prior to 15.5.7), VMware Fusion (12.x prior to 12.0 and 11.x prior to 11.5.7) and VMware Cloud Foundation contain a denial of service vulnerability due to improper input validation in GuestInfo. A malicious actor with normal user privilege access to a virtual machine can crash the virtual machine's vmx process leading to a denial of service condition.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

ESXi · VMware

95%

v < 16.07.0 7.0 beta 7.0 update_1 7.0 update_1a 7.0 update_1b

Affected range stops below 16.0, so it looks safe — our inference, not a vendor statement

Fusion · VMware

95%

v < 16.011.5.0 ≤ v < 11.5.7

Affected range stops below 11.5.7, so it looks safe — our inference, not a vendor statement

Affected range stops below 16.0, so it looks safe — our inference, not a vendor statement

apple-macos (environment)

Workstation · VMware

95%

v < 16.015.0.0 ≤ v < 15.5.7

Affected range stops below 15.5.7, so it looks safe — our inference, not a vendor statement

Affected range stops below 16.0, so it looks safe — our inference, not a vendor statement

Cloud Foundation · VMware

60%

v < 16.0

Affected range stops below 16.0, so it looks safe — our inference, not a vendor statement

Runs on — not affected

The affected product only carries this flaw when running on these platforms. The platforms themselves are not vulnerable.

macOS · Apple

95%

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://www.vmware.com/security/advisories/VMSA-2020-0029.html

References (1)

x_refsource_MISCPatchVendor Advisory

Source: [email protected]

https://www.vmware.com/security/advisories/VMSA-2020-0029.html

CVSS

6.5MEDIUM[email protected]

Attack Vector: LOCAL
Complexity: LOW
Privileges: LOW
User Interaction: NONE
Scope: CHANGED
Confidentiality: NONE
Integrity: NONE
Availability: HIGH

Vector?

Quick Info

StatusANALYZED

CWE

CWE-20

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card