Heap Overflow Vulnerability in VMware ESXi, Workstation, and Fusion

CVE-2020-3967

What is CVE-2020-3967?

VMware ESXi, Workstation, and Fusion are susceptible to a heap overflow vulnerability in the USB 2.0 controller (EHCI). This vulnerability allows a malicious actor with local access to a virtual machine to potentially execute code on the hypervisor. For the exploit to be successful, additional conditions must be present beyond the attacker's control, making it a complex scenario for unauthorized code execution. IT administrators should prioritize patching and securing their VMware products as indicated in the official advisory.

References