VulnerabilityModified
CVE-2019-5526
VMware Workstation (15.x before 15.1.0) contains a DLL hijacking issue because some DLL files are improperly loaded by the application.
HIGH 7.8EPSS 9.03%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (9.03%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
VMware Workstation (15.x before 15.1.0) contains a DLL hijacking issue because some DLL files are improperly loaded by the application. Successful exploitation of this issue may allow attackers with normal user privileges to escalate their privileges to administrator on a windows host where Workstation is installed.
- CVSS 3.0
- 7.8 HIGHCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 9.03% probability · 95th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-427
- Affected
- vmware/workstation
- Source
- security@vmware.com
References
- http://packetstormsecurity.com/files/152946/VMware-Workstation-DLL-Hijacking.htmlThird Party Advisory
- http://www.securityfocus.com/bid/108333Third Party Advisory, VDB Entry
- https://www.vmware.com/security/advisories/VMSA-2019-0007.htmlVendor Advisory
- http://packetstormsecurity.com/files/152946/VMware-Workstation-DLL-Hijacking.htmlThird Party Advisory
- http://www.securityfocus.com/bid/108333Third Party Advisory, VDB Entry
- https://www.vmware.com/security/advisories/VMSA-2019-0007.htmlVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.