VMware reveals critical hypervisor bugs found at Chinese white-hat hacking competition

CVE-2020-4004, rated 9.3 on the CVSS scale, is a “use-after-free vulnerability in XHCI USB controller” that allows attackers with local admin privileges on VM to execute code as the host VMX process.