CVE-2019-5526

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

VMware Workstation (15.x before 15.1.0) contains a DLL hijacking issue because some DLL files are improperly loaded by the application. Successful exploitation of this issue may allow attackers with normal user privileges to escalate their privileges to administrator on a windows host where Workstation is installed.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-427

Affected software

Vendor	Product	Versions
n/a	VMware Workstation	VMware Workstation (15.x before 15.1.0)

References

http://packetstormsecurity.com/files/152946/VMware-Workstation-DLL-Hijacking.htmlThird Party Advisory
http://www.securityfocus.com/bid/108333Third Party Advisory, VDB Entry
https://www.vmware.com/security/advisories/VMSA-2019-0007.htmlVendor Advisory
http://packetstormsecurity.com/files/152946/VMware-Workstation-DLL-Hijacking.htmlThird Party Advisory
http://www.securityfocus.com/bid/108333Third Party Advisory, VDB Entry
https://www.vmware.com/security/advisories/VMSA-2019-0007.htmlVendor Advisory

Timeline

Published: May 15, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-55278.8ESXi, Workstation, Fusion, VMRC and Horizon Client contain a use-after-free vulnerability in the virtual sound device. VMware has evaluated CVE-2019-55285.3VMware ESXi 6.5 suffers from partial denial of service vulnerability in hostd process. Patch ESXi650-201907201-UG for this issue is availabl CVE-2019-55307.8Windows binaries generated with InstallBuilder versions earlier than 19.7.0 are vulnerable to tampering even if they contain a valid Authent CVE-2019-55315.4VMware vSphere ESXi (6.7 prior to ESXi670-201810101-SG, 6.5 prior to ESXi650-201811102-SG, and 6.0 prior to ESXi600-201807103-SG) and VMware CVE-2019-55327.7VMware vCenter Server (6.7.x prior to 6.7 U3, 6.5 prior to 6.5 U3 and 6.0 prior to 6.0 U3j) contains an information disclosure vulnerability CVE-2019-55334.3In VMware SD-WAN by VeloCloud versions 3.x prior to 3.3.0, the VeloCloud Orchestrator parameter authorization check mistakenly allows enterp CVE-2019-55347.7VMware vCenter Server (6.7.x prior to 6.7 U3, 6.5 prior to 6.5 U3 and 6.0 prior to 6.0 U3j) contains an information disclosure vulnerability CVE-2019-55354.7VMware Workstation and Fusion contain a network denial-of-service vulnerability due to improper handling of certain IPv6 packets. VMware has CVE-2019-55366.5VMware ESXi (6.7 before ESXi670-201908101-SG and 6.5 before ESXi650-201910401-SG), Workstation (15.x before 15.5.0) and Fusion (11.x before CVE-2019-55375.9Sensitive information disclosure vulnerability resulting from a lack of certificate validation during the File-Based Backup and Restore oper CVE-2019-55385.9Sensitive information disclosure vulnerability resulting from a lack of certificate validation during the File-Based Backup and Restore oper CVE-2019-55397.8VMware Workstation (15.x prior to 15.5.1) and Horizon View Agent (7.10.x prior to 7.10.1 and 7.5.x prior to 7.5.4) contain a DLL hijacking v