CVE-2020-3946: VMware Installbuilder

High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days.

InstallBuilder AutoUpdate tool and regular installers enabling <checkForUpdates> built with versions earlier than 19.11 are vulnerable to Billion laughs attack (denial-of-service).

Affected products

• VMware Installbuilder: before 19.11.0 (fixed in 19.11.0)

Published 2020-04-20. Last modified 2026-06-17.