Skip to content
Fencer Vulns
high 8.8

CVE-2019-5512 json

VMware Workstation (15.x before 15.0.3, 14.x before 14.1.6) running on Windows does not handle COM classes appropriately.

published 2019-04-09 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-15087

cvss
8.8
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.2%
EPSS 1.2% chance of exploitation in 30 days, percentile 69%
public exploits
1
Exploit-DB

Summary

VMware Workstation (15.x before 15.0.3, 14.x before 14.1.6) running on Windows does not handle COM classes appropriately. Successful exploitation of this issue may allow hijacking of COM classes used by the VMX process, on a Windows host, leading to elevation of privilege.

Patch / fix

  • vmware workstation 14.1.6, 15.0.3

Timeline

  1. First public exploit (EDB-46601)
  2. Published

Exploit prediction

1.23% chance of exploitation in the next 30 days, higher than 69% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-46601 VMware Workstation 14.1.5 / VMware Player 15 - Host VMX Process COM Class Hijack Privilege Escalation local, 2019-03-25

CVSS scores

assigned by version score vector
NVD 3.0 8.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD 2.0 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C

Affected products

  • n/a VMware Workstation

Classification

Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.