CVE-2020-4004

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

VMware ESXi (7.0 before ESXi70U1b-17168206, 6.7 before ESXi670-202011101-SG, 6.5 before ESXi650-202011301-SG), Workstation (15.x before 15.5.7), Fusion (11.x before 11.5.7) contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
n/a	VMware ESXi	7.0 before ESXi70U1b-17168206; 6.7 before ESXi670-202011101-SG; 6.5 before ESXi650-202011301-SG
n/a	Workstation	15.x before 15.5.7
n/a	Fusion	11.x before 11.5.7

References

https://www.vmware.com/security/advisories/VMSA-2020-0026.htmlPatch, Vendor Advisory
https://www.vmware.com/security/advisories/VMSA-2020-0026.htmlPatch, Vendor Advisory

Timeline

Published: Nov 20, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-40057.8VMware ESXi (7.0 before ESXi70U1b-17168206, 6.7 before ESXi670-202011101-SG, 6.5 before ESXi650-202011301-SG) contains a privilege-escalatio CVE-2020-40069.1VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerabili CVE-2020-40083.6The installer of the macOS Sensor for VMware Carbon Black Cloud (prior to 3.5.1) handles certain files in an insecure way. A malicious actor CVE-2020-40135.4The review resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to inject arbitrary HTML or Javascript vi CVE-2020-40144.3The /profile/deleteWatch.do resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to remove another user's CVE-2020-40154.3The /json/fe/activeUserFinder.do resource in Altassian Fisheye and Crucible before version 4.8.1 allows remote attackers to view user user e CVE-2020-40165.3The /plugins/servlet/jira-blockers/ resource in the crucible-jira-ril plugin in Atlassian Fisheye and Crucible before version 4.8.1 allows r CVE-2020-40175.3The /rest/jira-ril/1.0/jira-rest/applinks resource in the crucible-jira-ril plugin in Atlassian Fisheye and Crucible before version 4.8.1 al CVE-2020-40188.8The setup resources in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to complete the setup process via a cross CVE-2020-40197.8The file editing functionality in the Atlassian Companion App before version 1.0.0 allows local attackers to have the app run a different ex CVE-2020-40207.2The file downloading functionality in the Atlassian Companion App before version 1.0.0 allows remote attackers, who control a Confluence Ser CVE-2020-40215.4Affected versions are: Before 8.5.5, and from 8.6.0 before 8.8.1 of Atlassian Jira Server and Data Center allow remote attackers to inject a