Incorrect permission assignment in VMware Horizon Client for Windows
Priority LOW 34CWE-732Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
For VMware Horizon Client for Windows (5.x and prior before 5.3.0), VMware Remote Console for Windows (10.x before 11.0.0), VMware Workstation for Windows (15.x before 15.5.2) the folder containing configuration files for the VMware USB arbitration service was found to be writable by all users. A local user on the system where the software is installed may exploit this issue to run commands as any user.
Why it matters now
EPSS 0.00391 33rd percentileScored 2026-11-07
Fix Fixed VMware Remote Console for Windows (VMware): 11.0.0VMware Workstation for Windows (VMware): 15.5.2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| VMware | VMware Horizon Client for Windows | 5.x and prior before 5.3.0 | — | No fix listed | CNA |
| VMware | VMware Remote Console for Windows | 10 to before 11.0.0 | 11.0.0 | Patch available | CNA |
| VMware | VMware Workstation for Windows | 15 to before 15.5.2 | 15.5.2 | Patch available | CNA |
- VMware Horizon Client for Windows VendorVMware Affected 5.x and prior before 5.3.0 Fixed in — No fix listed CNA
- VMware Remote Console for Windows VendorVMware Affected 10 to before 11.0.0 Fixed in 11.0.0 Patch available CNA
- VMware Workstation for Windows VendorVMware Affected 15 to before 15.5.2 Fixed in 15.5.2 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vmware:horizon_client:*:*:*:*:*:*:*:* | 5.0.0 to before 5.3.0 | Vulnerable | VMware |
| cpe:2.3:a:vmware:remote_console:*:*:*:*:*:*:*:* | 10.0.0 to before 11.0.0 | Vulnerable | VMware |
| cpe:2.3:a:vmware:workstation:*:*:*:*:*:*:*:* | 15.0.0 to before 15.5.2 | Vulnerable | VMware |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
- cpe:2.3:a:vmware:horizon_client:*:*:*:*:*:*:*:* Versions 5.0.0 to before 5.3.0 Vulnerable ·VMware
- cpe:2.3:a:vmware:remote_console:*:*:*:*:*:*:*:* Versions 10.0.0 to before 11.0.0 Vulnerable ·VMware
- cpe:2.3:a:vmware:workstation:*:*:*:*:*:*:*:* Versions 15.0.0 to before 15.5.2 Vulnerable ·VMware
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
Remediation
- Fix · CNA VMware Remote Console for Windows (VMware) Fixed in 11.0.0
- Fix · CNA VMware Workstation for Windows (VMware) Fixed in 15.5.2
Timeline
- 2026-10-02 Threatist record created from CVE-2019-5543
- 2026-10-03 Alias added: GHSA-r5j5-qr4j-4j6w
References
More VMware Horizon Client vulnerabilities
- TI-2020-03448 Improper privilege management in VMware Fusion, VMware Remote Console for Mac and Horizon… KEVCVSS 3.1HIGH 7.8
- TI-2020-03472 VMware Fusion (11.x before 11.5.5), VMware Remote Console for Mac (11.x and prior before… CVSS 3.1HIGH 7.8
- TI-2020-03459 Incorrect permission assignment in VMware Horizon Client for Windows CVSS 3.1HIGH 7.8
- TI-2018-05086 VMware Horizon Client for Linux (4.x before 4.8.0 and prior) contains a local privilege… CVSS 3.0HIGH 7.8
- TI-2018-05092 Out-of-bounds read in VMware Horizon 6, Horizon 7, and Horizon Client CVSS 3.0MEDIUM 6.5
- TI-2020-03494 VMware Horizon Client for Windows (5.x prior to 5.5.0) contains an information disclosure… CVSS 3.1MEDIUM 6.5
Sources
- CVE-2019-5543 · CVE Program
- CVE-2019-5543 · NVD
- FIRST EPSS
- GHSA-r5j5-qr4j-4j6w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences