TI-2020-03447 Aliases CVE-2020-3948 GHSA-8vx8-8442-ph7f

Incorrect permission assignment in VMware Workstation

LOW 34CWE-732Published 2020-03-16 · Updated 2024-08-04

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Linux Guest VMs running on VMware Workstation (15.x before 15.5.2) and Fusion (11.x before 11.5.2) contain a local privilege escalation vulnerability due to improper file permissions in Cortado Thinprint. Local attackers with non-administrative access to a Linux guest VM with virtual printing enabled may exploit this issue to elevate their privileges to root on the same guest VM.

Why it matters now

EPSS 0.00282 20th percentileScored 2026-11-07

Fix Fixed Workstation (VMware): 15.5.2Fusion (VMware): 11.5.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
VMware	Workstation	15 to before 15.5.2	15.5.2	Patch available	CNA
VMware	Fusion	11 to before 11.5.2	11.5.2	Patch available	CNA

Workstation VendorVMware Affected 15 to before 15.5.2 Fixed in 15.5.2 Patch available CNA
Fusion VendorVMware Affected 11 to before 11.5.2 Fixed in 11.5.2 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:vmware:fusion::::::::	11.0.0 to before 11.5.2	Vulnerable	VMware
cpe:2.3:a:vmware:workstation::::::::	15.0.0 to before 15.5.2	Vulnerable	VMware

cpe:2.3:a:vmware:fusion:*:*:*:*:*:*:*:* Versions 11.0.0 to before 11.5.2 Vulnerable ·VMware
cpe:2.3:a:vmware:workstation:*:*:*:*:*:*:*:* Versions 15.0.0 to before 15.5.2 Vulnerable ·VMware

Remediation

Fix · CNA Workstation (VMware) Fixed in 15.5.2
Fix · CNA Fusion (VMware) Fixed in 11.5.2

Timeline

2026-10-02 Threatist record created from CVE-2020-3948
2026-10-03 Alias added: GHSA-8vx8-8442-ph7f

References

Advisory 1

https://www.vmware.com/security/advisories/VMSA-2020-0004.html

TI-2020-03448 Improper privilege management in VMware Fusion, VMware Remote Console for Mac and Horizon… KEVCVSS 3.1HIGH 7.8
TI-2025-16137 Out-of-bounds read in ESXi KEVCVSS 3.1HIGH 7.1
TI-2017-03716 Observable discrepancy in Intel Most Modern Operating Systems CVSS 3.1MEDIUM 5.6
TI-2017-03034 Memory corruption in VMware Workstation Pro/Player CVSS 3.0CRITICAL 9.9
TI-2016-04622 Untrusted search path vulnerability in the HGFS (aka Shared Folders) feature in VMware… CVSS 3.1HIGH 7.8
TI-2011-03420 Buffer overflow in VMware Workstation 7.x before 7.1.5, VMware Player 3.x before 3.1.5… CVSS 2.0HIGH 9.3

See all 130 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences