How to Fix CVE-2020-3950: Privilege escalation vulnerability

By the Sai Kiran Pandrala · Reviewed and edited by Sai Kiran Pandrala, Editor

⚠️ Patch immediately. CVE-2020-3950 is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03). Federal agencies had until 2022-05-03 to remediate.

What is CVE-2020-3950?

CVE-2020-3950 is a local privilege escalation flaw in the macOS desktop products VMware Fusion, VMware Remote Console (VMRC) for Mac, and Horizon Client for Mac. VMware tracked it as CWE-269, Improper Privilege Management. The root cause, per the vendor description, is improper use of setuid binaries that ship with these products on macOS.

A setuid binary runs with the privileges of its file owner, not the user who launches it. When such a binary is owned by root and does not carefully validate its environment, inputs, or the helper paths it calls, a normal user can manipulate it into running attacker-controlled code as root. That is exactly what happens here. The two Packet Storm advisories in the references trace the issue to the USB Arbitrator service helper that Fusion installs.

What an attacker gets: this is elevation of privilege, not remote code execution. The attacker must already have a normal user account and the ability to run code on the Mac. From there, exploitation lets them escalate to root on the machine where Fusion, VMRC, or Horizon Client is installed. The CVSS 3.1 vector confirms this profile: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. local attack vector, low privileges required, no user interaction, full compromise of confidentiality, integrity, and availability once exploited.

Despite needing local access, CISA added CVE-2020-3950 to its Known Exploited Vulnerabilities catalog on 2021-11-03. Public exploit code exists and is in active use, which is why this sits on the mandatory-patch list. On a shared Mac, a multi-user lab machine, or any endpoint where you do not fully trust every local account, this is a clean path from a standard user to root.

What you'll see

You are affected if any of the three Mac products is installed below its fixed version. Run these checks in Terminal on the Mac to read the installed build:

# VMware Fusion version
defaults read /Applications/VMware\ Fusion.app/Contents/Info.plist CFBundleShortVersionString

# VMware Remote Console for Mac version
defaults read "/Applications/VMware Remote Console.app/Contents/Info.plist" CFBundleShortVersionString

# Horizon Client for Mac version
defaults read "/Applications/VMware Horizon Client.app/Contents/Info.plist" CFBundleShortVersionString

Compare the output against the fixed releases: Fusion must be 11.5.2 or later, VMRC for Mac 11.0.1 or later, and Horizon Client for Mac 5.4.0 or later. Anything below those numbers is vulnerable. Note that there is no Windows or Linux exposure for this CVE, the setuid mechanism it abuses exists only in the macOS builds.

How to fix CVE-2020-3950

The fix is to upgrade the affected Mac product to its patched version. There is no configuration change that closes the hole; you must install the fixed build. Per VMware advisory VMSA-2020-0005:

• VMware Fusion: upgrade to 11.5.2 or later.
• VMware Remote Console for Mac, upgrade to 11.0.1 or later.
• Horizon Client for Mac. upgrade to 5.4.0 or later.

Upgrade VMware Fusion

Quit any running virtual machines first, then use the in-app updater: open Fusion, choose VMware Fusion → Check for Updates from the menu bar, and let it download and install 11.5.2 or later. The updater replaces the vulnerable setuid helper with the patched one. If your fleet blocks the in-app updater, download the 11.5.2+ installer from your VMware/Broadcom account portal and run the .dmg:

# After downloading the patched installer .dmg from your licensed portal:
hdiutil attach ~/Downloads/VMware-Fusion-11.5.2.dmg
sudo installer -pkg "/Volumes/VMware Fusion/Install VMware Fusion.app/Contents/Resources/VMware Fusion.pkg" -target /
hdiutil detach "/Volumes/VMware Fusion"

(Some Fusion releases ship as a drag-to-Applications app bundle rather than a .pkg; in that case quit Fusion, drag the new VMware Fusion.app over the old one in /Applications, and launch it once so it installs the updated helper.)

Upgrade VMRC and Horizon Client for Mac

VMware Remote Console and Horizon Client for Mac do not auto-patch in place. Download VMRC 11.0.1+ or Horizon Client 5.4.0+ from the official VMware/Broadcom download page (linked in References), then install the new build over the old one:

# Example for Horizon Client for Mac (adjust filename to the build you downloaded)
hdiutil attach ~/Downloads/VMware-Horizon-Client-5.4.0.dmg
cp -R "/Volumes/VMware Horizon Client/VMware Horizon Client.app" /Applications/
hdiutil detach "/Volumes/VMware Horizon Client"

# Launch once so the updated privileged helper is registered, then verify:
defaults read "/Applications/VMware Horizon Client.app/Contents/Info.plist" CFBundleShortVersionString

For a managed fleet, push the patched .dmg through your MDM (Jamf, Kandji, Intune for Mac) as a standard app-deployment policy targeting the affected machines. Confirm the policy reports the new CFBundleShortVersionString before you close the change.

If you can't patch immediately

VMware published no workaround in VMSA-2020-0005. Upgrading is the only documented remediation. The measures below shrink the window of exposure but do not remove the vulnerable setuid binary, so treat them strictly as stopgaps:

• Restrict local access. Because exploitation requires a local, logged-in user, limit who can sign in to the affected Mac. Remove unneeded standard accounts and disable guest login under System Settings → Users & Groups.
• Quit the product when idle. Close Fusion, VMRC, and Horizon Client when they are not in use so the privileged helper is not running. This does not delete the setuid binary on disk, but it reduces the active attack surface.
• Watch for unexpected root activity. Audit for unexpected processes spawned by the VMware helper binaries. On endpoints with EDR, alert on child processes of the USB Arbitrator helper.

Verify the fix

After upgrading, re-read the bundle version and confirm it meets or exceeds the fixed release for that product:

defaults read /Applications/VMware\ Fusion.app/Contents/Info.plist CFBundleShortVersionString
# Expect: 11.5.2 or higher

defaults read "/Applications/VMware Remote Console.app/Contents/Info.plist" CFBundleShortVersionString
# Expect: 11.0.1 or higher

defaults read "/Applications/VMware Horizon Client.app/Contents/Info.plist" CFBundleShortVersionString
# Expect: 5.4.0 or higher

Then re-run whatever scanner originally flagged the host and confirm the CVE-2020-3950 finding has cleared. If you suspect the machine was exploited before patching, treat the local root compromise seriously: review for unauthorized accounts, launch agents, and persistence, and rebuild if you cannot account for the changes.

Frequently asked questions

Which versions fix CVE-2020-3950?

VMware Fusion 11.5.2, VMware Remote Console for Mac 11.0.1, and Horizon Client for Mac 5.4.0 are the fixed releases. Per VMSA-2020-0005, upgrade the affected Mac product to at least its listed version.

Does CVE-2020-3950 affect Windows or Linux installs of these products?

No. The flaw is specific to the Mac builds. It stems from improper use of setuid binaries on macOS, so the Windows and Linux versions of these clients are not affected by this CVE.

Why is a privilege escalation bug on a desktop app on the CISA KEV list?

A local attacker with normal user privileges can escalate to root on the Mac where the product is installed. CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-03 because working exploit code is in active use, which makes it a priority despite needing local access.

Is there a workaround if I cannot upgrade immediately?

VMware published no workaround in VMSA-2020-0005; upgrading to the fixed version is the only documented remediation. As interim hardening, restrict who can log in locally to the affected Mac and quit the VMware product when it is not in use.

References

• Official vendor advisory: https://www.vmware.com/security/advisories/VMSA-2020-0005.html
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2020-3950
• CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Additional reference: http://packetstormsecurity.com/files/156843/VMware-Fusion-11.5.2-Privilege-Escalation.html
• Additional reference: http://packetstormsecurity.com/files/157079/VMware-Fusion-USB-Arbitrator-Setuid-Privilege-Escalation.html

Written by Sai Kiran Pandrala on 2026-05-25. Sourced from the official vendor advisory, the NVD record, and the CISA KEV listing. Always confirm against the vendor advisory before applying changes in production.

Related fixes

Related weaknesses in the same component worth addressing at the same time:

• How to Fix CVE-2020-5410: CWE-23: Relative Path Traversal in VMware Tanzu Spring Cloud Configuration (Config) Server
• How to Fix CVE-2020-3952: Critical Information Disclosure in VMware vCenter Server
• How to Fix CVE-2020-3992: Remote code execution vulnerability in VMware ESXi
• How to Fix CVE-2020-4006: Command Injection