CVE-2019-5539

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

VMware Workstation (15.x prior to 15.5.1) and Horizon View Agent (7.10.x prior to 7.10.1 and 7.5.x prior to 7.5.4) contain a DLL hijacking vulnerability due to insecure loading of a DLL by Cortado Thinprint. Successful exploitation of this issue may allow attackers with normal user privileges to escalate their privileges to administrator on a Windows machine where Workstation or View Agent is installed.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-427

Affected software

Vendor	Product	Versions
VMware	VMware Workstation	15.x prior to 15.5.1
VMware	Horizon View Agent	7.10.x prior to 7.10.1; 7.5.x prior 7.5.4

References

https://www.vmware.com/security/advisories/VMSA-2019-0023.htmlPatch, Vendor Advisory
https://www.vmware.com/security/advisories/VMSA-2019-0023.htmlPatch, Vendor Advisory

Timeline

Published: Dec 23, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-55407.7VMware Workstation (15.x before 15.5.1) and Fusion (11.x before 11.5.1) contain an information disclosure vulnerability in vmnetdhcp. Succes CVE-2019-55419.1VMware Workstation (15.x before 15.5.1) and Fusion (11.x before 11.5.1) contain an out-of-bounds write vulnerability in the e1000e virtual n CVE-2019-55427.7VMware Workstation (15.x before 15.5.1) and Fusion (11.x before 11.5.1) contain a denial-of-service vulnerability in the RPC handler. Succes CVE-2019-55437.8For VMware Horizon Client for Windows (5.x and prior before 5.3.0), VMware Remote Console for Windows (10.x before 11.0.0), VMware Workstati CVE-2019-55449.8OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in CVE-2019-55856.1An improper access control vulnerability in FortiClientMac before 6.0.5 may allow an attacker to affect the application's performance via mo CVE-2019-55866.1A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiOS 5.2.0 to 5.6.10, 6.0.0 to 6.0.4 under SSL VPN web portal may allow CVE-2019-55876.5Lack of root file system integrity checking in Fortinet FortiOS VM application images all versions below 6.0.5 may allow attacker to implant CVE-2019-55886.1A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4 under SSL VPN web portal may allow an attacker to ex CVE-2019-55898.8A untrusted search path vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitable CVE-2019-55906.1The URL part of the report message is not encoded in Fortinet FortiWeb 6.0.2 and below which may allow an attacker to execute unauthorized c CVE-2019-55916.5A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information