---
id: 4666
title: "[CVE-2023-20869] Chaining N-days to Compromise All: Part 5 — VMware Workstation Guest-to-Host Escape"
cve: CVE-2023-20869
source_domain: theori.io
source_url: "https://theori.io/blog/chaining-n-days-to-compromise-all-part-5-vmware-workstation-host-to-guest-escape"
published_at: "2024-05-02T15:00:00Z"
tags: ["vmware", "bluetooth", "pwn2own", "cve-2023-20869", "guest-to-host"]
phying_url: "https://phying.com/item/4666"
lang: en
---

# [CVE-2023-20869] Chaining N-days to Compromise All: Part 5 — VMware Workstation Guest-to-Host Escape

## Summary

Part five of the chain: how CVE-2023-20869 in VMware Workstation’s virtual Bluetooth SDP handling lets a guest execute arbitrary code on the host, with root-cause analysis and a working PoC.

## Intelligence Metadata

- **Sources:** theori.io
- **CVE:** CVE-2023-20869
- **Published:** 2024-05-02T15:00:00Z
- **Original:** https://theori.io/blog/chaining-n-days-to-compromise-all-part-5-vmware-workstation-host-to-guest-escape
- **Phying News:** https://phying.com/item/4666