CVE-2019-5526

Imagine VMware Workstation looks for helper files when you run it. In this case, it can be tricked into loading a fake “helper” file placed by an attacker, and that fake file can run with much higher privileges than it normally should.

For a business, that’s like letting someone plant a malicious plug-in that, once you launch the app, gives them control over your computer.

This matters if you use VMware Workstation on Windows (a desktop/laptop virtualization tool) and you’re running VMware Workstation 15.x versions before 15.1.0.

It’s only a realistic risk when an attacker already has basic local user privileges and can place a malicious file in a location VMware Workstation searches, and when a victim launches Workstation (user interaction).

This is an AMBER issue because a local attacker who can get basic user privileges can potentially escalate to administrator on the workstation by planting a fake file.

Even though it requires the victim to launch VMware Workstation, the fix is straightforward (upgrade), and vulnerable default installations are known to be affected.

1. Confirm exposure

   • On the affected machine, open VMware Workstation and check the exact installed version.
   • Determine whether it is VMware Workstation 15.x and whether it is older than 15.1.0.

2. Upgrade to the fixed version

   • Upgrade VMware Workstation to 15.1.0.
   • If you manage multiple hosts, prioritize systems used by admins and systems with sensitive data.

3. Temporary containment if patching is delayed

   • Reduce who can place files on the host: limit write access to common download/extract locations and any directories that could be searched by the application.
   • Review local user accounts and remove unnecessary users/groups that can write to shared or user-writable locations.
   • Treat any suspicious file drops or unexpected binaries as a potential attempt to stage malicious files for this issue.

4. Verification after patch

   • Re-check the VMware Workstation version and confirm it is 15.1.0 or newer.
   • Ensure normal virtualization use still works (start a VM, confirm device access, and check that Workstation launches normally).

5. Guidance reference

   • Follow the vendor’s remediation guidance in VMSA-2019-0007.

Note: KEV is not listed for this CVE, but public exploits exist, so you should assume active risk on vulnerable, user-launched systems where attackers can stage files.

Severity is reported as HIGH (CVSS 7.8). The weakness is CWE-427 (DLL hijacking), and the mechanism is improper loading of certain DLL/helper components, which can be replaced with malicious files placed by an attacker.

Attack vector is local: an attacker needs normal user privileges to place a malicious file in a location searched by VMware Workstation. User interaction is required because the victim must launch the compromised application (Workstation). On successful exploitation, an attacker can escalate privileges to local administrator on the Windows host.

Exploit maturity: there are public exploits available (2 known). KEV is not listed, so it’s not confirmed via CISA KEV for this issue. EPSS is a prediction (trend flat) and is not the basis for prioritization given the existence of public exploits and the availability of a clear fixed version (15.1.0).