This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] VMware ESXi, Workstation, Fusion and Tools fix 4 vulnerabilities

VMware fixes 4 vulnerabilities in VMware ESXi, Workstation, Fusion and Tools [1][2]. Products and their fixes [1]: VMware ESXi - ESXi80U2e-24789317, ESXi80U3f-24784735, ESXi70U3w-24784741 VMware Workstation - 17.6.4 VMware Fusion - 13.6.4 VMware Tools - 13.0.1.0, 12.5.3 (Windows)

VMware ESXi, Workstation and Fusion - code execution (CVE-2025-41236)
CVSS 9.3 (Critical)

An unauthenticated local attacker with administrator privileges on a virtual machine is, due to an integer-overflow vulnerability in the VMXNET3 virtual network adapter, allowed to execute arbitrary code [1][3].

The vulnerability is present in products:

  • VMware ESXi; >=8.0.0, <ESXi80U2e-24789317; >=8.0.0, <ESXi80U3f-24784735; >=7.0.0, <ESXi70U3w-24784741
  • VMware Workstation; >=17.0.0, <17.6.4
  • VMware Fusion; >=13.0.0, <13.6.4

CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 16. 7. 2025.

VMware ESXi, Workstation and Fusion - code execution (CVE-2025-41237)
CVSS 9.3 (Critical)

An unauthenticated local attacker with administrator privileges on a virtual machine is, due to an integer-underflow vulnerability in VMCI (Virtual Machine Communication Interface), allowed to execute code as the VMX process on the host. In the case of ESXi, exploitation is limited to the VMX process sandbox, whereas on Workstation and Fusion it may lead to code execution directly on the device where Workstation or Fusion is installed [1][4].

The vulnerability is present in products:

  • VMware ESXi; >=8.0.0, <ESXi80U2e-24789317; >=8.0.0, <ESXi80U3f-24784735; >=7.0.0, <ESXi70U3w-24784741
  • VMware Workstation; >=17.0.0, <17.6.4
  • VMware Fusion; >=13.0.0; <13.6.4

CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 16. 7. 2025.

VMware ESXi, Workstation and Fusion - code execution (CVE-2025-41238)
CVSS 9.3 (Critical)

An unauthenticated local attacker with administrator privileges on a virtual machine is, due to a heap-overflow vulnerability in the PVSCSI controller, allowed to execute code as the VMX process on the host. On ESXi, exploitation is limited by a sandbox and is possible only in an unsupported configuration, whereas on Workstation and Fusion it may lead to code execution on the host system [1][5].

The vulnerability is present in products:

  • VMware ESXi; >=8.0.0, <ESXi80U2e-24789317; >=8.0.0, <ESXi80U3f-24784735; >=7.0.0, <ESXi70U3w-24784741
  • VMware Workstation; >=17.0.0, <17.6.4
  • VMware Fusion; >=13.0.0, <13.6.4

CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 16. 7. 2025.

VMware ESXi, Workstation, Fusion and Tools - memory leak (CVE-2025-41239)
CVSS 7.1 (High)

An unauthenticated local attacker with administrator privileges on a virtual machine, due to the use of uninitialized memory in vSockets, is able to obtain memory contents from processes communicating through them [1][6].

The vulnerability is present in products:

  • VMware ESXi; >=8.0.0, <ESXi80U2e-24789317; >=8.0.0, <ESXi80U3f-24784735; >=7.0.0, <ESXi70U3w-24784741
  • VMware Workstation; >=17.0.0, <17.6.4
  • VMware Fusion; >=13.0.0, <13.6.4
  • VMware Tools; >=13.0.0, <13.0.1.0; >=12.0.0, <12.5.3 ; =11.0.0

CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

More information:

The vulnerability was publicly disclosed 16. 7. 2025.

By CESNET, z.s.p.o. Michaela Jarošová on 24. 7. 2025.

CESNET, z.s.p.o. Logo