CVE-2020-3970

LowCVSS 3.8/10Last modified Jun 17, 2026

Description

VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.5), and Fusion (11.x before 11.5.5) contain an out-of-bounds read vulnerability in the Shader functionality. A malicious actor with non-administrative local access to a virtual machine with 3D graphics enabled may be able to exploit this vulnerability to crash the virtual machine's vmx process leading to a partial denial of service condition.

Metrics

CVSS 3.1 3.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
VMware	VMware ESXi	7.0 before ESXi_7.0.0-1.20.16321839; 6.7 before ESXi670-202004101-SG; 6.5 before ESXi650-202005401-SG
VMware	Workstation	15.x before 15.5.5
VMware	Fusion	11.x before 11.5.5

References

https://www.vmware.com/security/advisories/VMSA-2020-0015.htmlVendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-20-782/Third Party Advisory
https://www.vmware.com/security/advisories/VMSA-2020-0015.htmlVendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-20-782/Third Party Advisory

Timeline

Published: Jun 25, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-39715.5VMware ESXi (6.7 before ESXi670-201904101-SG and 6.5 before ESXi650-201907101-SG), Workstation (15.x before 15.0.2), and Fusion (11.x before CVE-2020-39723.3VMware Tools for macOS (11.x.x and prior before 11.1.1) contains a denial-of-service vulnerability in the Host-Guest File System (HGFS) impl CVE-2020-39738.8The VeloCloud Orchestrator does not apply correct input validation which allows for blind SQL-injection. A malicious actor with tenant acces CVE-2020-39747.8VMware Fusion (11.x before 11.5.5), VMware Remote Console for Mac (11.x and prior before 11.2.0 ) and Horizon Client for Mac (5.x and prior CVE-2020-39755.4VMware App Volumes 2.x prior to 2.18.6 and VMware App Volumes 4 prior to 2006 contain a Stored Cross-Site Scripting (XSS) vulnerability. A m CVE-2020-39765.3VMware ESXi and vCenter Server contain a partial denial of service vulnerability in their respective authentication services. VMware has eva CVE-2020-39776.5VMware Horizon DaaS (7.x and 8.x before 8.0.1 Update 1) contains a broken authentication vulnerability due to a flaw in the way it handled t CVE-2020-39797.8InstallBuilder for Qt Windows (versions prior to 20.7.0) installers look for plugins at a predictable location at initialization time, writa CVE-2020-39806.7VMware Fusion (11.x) contains a privilege escalation vulnerability due to the way it allows configuring the system wide path. An attacker wi CVE-2020-39815.8VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202008101-SG, 6.5 before ESXi650-202007101-SG), Workstation (15.x), Fusi CVE-2020-39827.7VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202008101-SG, 6.5 before ESXi650-202007101-SG), Workstation (15.x), Fusi CVE-2020-39846.5The SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3 and 3.4.x prior to 3.4.4 does not apply correct input validation which allows for SQL-inject