PT-2025-29584 · Vmware · Vmware Fusion+2

Published

2025-07-15

·

Updated

2026-03-16

·

CVE-2025-41236

CVSS v3.1

9.3

Critical

VectorAV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions VMware ESXi, Workstation, and Fusion versions (affected versions not specified)
Description VMware ESXi, Workstation, and Fusion contain an integer-overflow vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a virtual machine with a VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Non-VMXNET3 virtual adapters are not affected. The vulnerability is related to a buffer overflow in the VMXNET3 virtual network adapter. Exploitation could allow an attacker to execute arbitrary code.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2025-08590
CVE-2025-41236
ZDI-26-189

Affected Products

Vmware Esxi
Vmware Fusion
Vmware Workstation