Read the docs
TI-2020-03495 Aliases CVE-2020-3999GHSA-x697-2xrm-fh6r

Improper input validation in VMware ESXi, VMware Workstation,VMware Fusion and VMware…

Priority LOW 29CWE-20Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

VMware ESXi (7.0 prior to ESXi70U1c-17325551), VMware Workstation (16.x prior to 16.0 and 15.x prior to 15.5.7), VMware Fusion (12.x prior to 12.0 and 11.x prior to 11.5.7) and VMware Cloud Foundation contain a denial of service vulnerability due to improper input validation in GuestInfo. A malicious actor with normal user privilege access to a virtual machine can crash the virtual machine's vmx process leading to a denial of service condition.

Why it matters now

EPSS 0.00383 32nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—VMware ESXi, VMware Workstation,VMware Fusion and VMware Cloud FoundationVMware ESXi (7.0 prior to ESXi70U1c-17325551), VMware Workstation (16.x prior to 16.0 and 15.x prior to 15.5.7)and VMware Fusion (12.x prior to 12.0 and 11.x prior to 11.5.7)—No fix listedCNA
  • VMware ESXi, VMware Workstation,VMware Fusion and VMware Cloud Foundation Vendor— Affected VMware ESXi (7.0 prior to ESXi70U1c-17325551), VMware Workstation (16.x prior to 16.0 and 15.x prior to 15.5.7)and VMware Fusion (12.x prior to 12.0 and 11.x prior to 11.5.7) Fixed in — No fix listed CNA

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:vmware:workstation:*:*:*:*:*:*:*:*15.0.0 to before 15.5.7VulnerableVMware
cpe:2.3:o:vmware:esxi:7.0:-:*:*:*:*:*:*7.0VulnerableVMware
cpe:2.3:o:vmware:esxi:7.0:beta:*:*:*:*:*:*7.0 betaVulnerableVMware
cpe:2.3:o:vmware:esxi:7.0:update_1:*:*:*:*:*:*7.0 update_1VulnerableVMware
cpe:2.3:o:vmware:esxi:7.0:update_1a:*:*:*:*:*:*7.0 update_1aVulnerableVMware
cpe:2.3:o:vmware:esxi:7.0:update_1b:*:*:*:*:*:*7.0 update_1bVulnerableVMware
cpe:2.3:a:vmware:fusion:*:*:*:*:*:*:*:*11.5.0 to before 11.5.7VulnerableVMware
cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*not specified by NVDRunning onApple
  • cpe:2.3:a:vmware:workstation:*:*:*:*:*:*:*:* Versions 15.0.0 to before 15.5.7 Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:7.0:-:*:*:*:*:*:* Versions 7.0 Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:7.0:beta:*:*:*:*:*:* Versions 7.0 beta Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:7.0:update_1:*:*:*:*:*:* Versions 7.0 update_1 Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:7.0:update_1a:*:*:*:*:*:* Versions 7.0 update_1a Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:7.0:update_1b:*:*:*:*:*:* Versions 7.0 update_1b Vulnerable ·VMware
  • cpe:2.3:a:vmware:fusion:*:*:*:*:*:*:*:* Versions 11.5.0 to before 11.5.7 Vulnerable ·VMware
  • cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-3999
  2. 2026-10-03 Alias added: GHSA-x697-2xrm-fh6r

References

Patch 1

  • TI-2020-03488 Use after free in VMware ESXi KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-16135 Time-of-check time-of-use race condition in VMware ESXi KEVCVSS 3.1CRITICAL 9.3
  • TI-2025-16136 Out-of-bounds write in VMware ESXi KEVCVSS 3.1HIGH 8.2
  • TI-2010-03709 The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS)… KEVCVSS 3.1HIGH 7.8
  • TI-2024-24615 Authentication bypass in VMware ESXi KEVCVSS 3.1HIGH 7.2
See all 139 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences