CVE-2020-3957 json
VMware Fusion (11.x before 11.5.5), VMware Remote Console for Mac (11.x and prior) and VMware Horizon Client for Mac (5.x and prior) contai…
published 2020-05-29 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-25222
- cvss
- 7.0
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 12%
- public exploits
- 0
- none known
Summary
VMware Fusion (11.x before 11.5.5), VMware Remote Console for Mac (11.x and prior) and VMware Horizon Client for Mac (5.x and prior) contain a local privilege escalation vulnerability due to a Time-of-check Time-of-use (TOCTOU) issue in the service opener. Successful exploitation of this issue may allow attackers with normal user privileges to escalate their privileges to root on the system where Fusion, VMRC and Horizon Client are installed.
Patch / fix
- vmware fusion 11.5.5
Exploit prediction
0.22% chance of exploitation in the next 30 days, higher than 12% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.0 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.9 | AV:L/AC:M/Au:N/C:C/I:C/A:C |
Affected products
- VMware VMware Fusion
- VMware VMware Remote Console for Mac
- VMware VMware Horizon Client for Mac
Classification
- Weakness
-
- CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
- Technology feeds
References
-
vmware.com
/security/advisories/VMSA-2020-0011.html
vendor-advisory
Sources
- CVE List CVE-2020-3957
- NVD CVE-2020-3957
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.