CVE-2020-3992 VMware ESXi OpenSLP Use-After-Free

Exploited in the wild Critical 9.8 Published 20 Oct 2020 Updated 12 Aug 2026

A malicious actor on the management network can trigger a use-after-free in OpenSLP to achieve remote code execution on VMware ESXi hosts.

Exploited in the wild: Since 3 Nov 2021
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-3992?

CVE-2020-3992 is a critical use after free vulnerability in Vmware Cloud Foundation, published on 20 Oct 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a use-after-free issue. A malicious actor residing in the management network who has access to port 427 on an ESXi machine may be able to trigger a use-after-free in the OpenSLP service resulting in remote code execution.

Weakness: CWE-416

Which versions are affected by CVE-2020-3992?

It affects 2 products.

Products include Vmware Cloud Foundation, Vmware Esxi.

How do I fix CVE-2020-3992?

No fix has been published for CVE-2020-3992 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 3 May 2022.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2020-3992 being exploited?

Yes. Attackers have exploited CVE-2020-3992 in the wild since at least 3 Nov 2021, including in ransomware campaigns.

Public exploit code: 2 proofs of concept on GitHub.

All Vmware Cloud Foundation vulnerabilities

Sources

Also known as GHSA-58ff-49fr-3jwf.