Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2019-5541: VMware Workstation/Fusion could let guest take over host

CVE-2019-5541 · published 6 years ago

Summary

VMware Workstation 15 (before 15.5.1) and Fusion 11 (before 11.5.1) have a flaw in their virtual network card that can be triggered from a virtual machine. An attacker could use it to run code on the computer running the virtual machines or cause the virtual machine to crash. Update the products to the latest versions that include the fix, or apply the supplied patches as soon as possible.

What to do

Update vmware workstation to version 15.5.1 or later.
Update vmware fusion to version 11.5.1 or later.

Affected software

Vendor	Product	Affected versions
vmware	workstation	>= 15.0.0, < 15.5.1 `cpe:2.3:a:vmware:workstation::::::::`
vmware	fusion	>= 11.0.0, < 11.5.1 `cpe:2.3:a:vmware:fusion::::::::`

Original advisory text

VMware Workstation (15.x before 15.5.1) and Fusion (11.x before 11.5.1) contain an out-of-bounds write vulnerability in the e1000e virtual network adapter. Successful exploitation of this issue may lead to code execution on the host from the guest or may allow attackers to create a denial-of-service condition on their own VM.

References

https://www.vmware.com/security/advisories/VMSA-2019-0021.html Patch Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

9.1 Critical

Exploitation

1% chance of attack within 30 days

Type

CWE-787Out-of-bounds Write

Timeline

Published20 Nov 2019

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2019-5541 · NVD

Track software like this

Free during beta