CVE-2020-3941 json
The repair operation of VMware Tools for Windows 10.x.y has a race condition which may allow for privilege escalation in the Virtual Machin…
published 2020-01-15 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-25206
- cvss
- 7.0
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 23%
- public exploits
- 0
- none known
Summary
The repair operation of VMware Tools for Windows 10.x.y has a race condition which may allow for privilege escalation in the Virtual Machine where Tools is installed. This vulnerability is not present in VMware Tools 11.x.y since the affected functionality is not present in VMware Tools 11.
Patch / fix
- vmware tools 11.0.0
Exploit prediction
0.31% chance of exploitation in the next 30 days, higher than 23% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.0 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 4.4 | AV:L/AC:M/Au:N/C:P/I:P/A:P |
Affected products
- VMware VMware Tools for Windows (VMware Tools)
Classification
- Weakness
-
- CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization
- Technology feeds
References
-
vmware.com
/security/advisories/VMSA-2020-0002.html
vendor-advisory
Sources
- CVE List CVE-2020-3941
- NVD CVE-2020-3941
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.