CVE-2025-41237: fallo crítico en VMware ESXi
VMCI integer-underflow vulnerability
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.3epss 0.5%
VMware ESXi, Workstation, and Fusion contain an integer-underflow in VMCI (Virtual Machine Communication Interface) that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox whereas, on Workstation and Fusion, this may lead to code execution on the machine where Workstation or Fusion is installed.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Productos afectados
VMware · Cloud FoundationVMware · ESXiVMware · FusionVMware · Telco Cloud InfrastructureVMware · Telco Cloud PlatformVMware · vSphere FoundationVMware · WorkstationCVEs relacionadas — VMware ESXi
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-59310CRITICALvCenter directory-traversal vulnerabilityEPSS 61.7%KEVCVE-2025-22224CRITICALCVE-2025-22224EPSS 1.6%KEVCVE-2026-41709LOWESX insufficient logging vulnerabilityEPSS 0.7%KEVCVE-2017-4933—CVE-2017-4933EPSS 3.6%CVE-2025-41239HIGHvSockets information-disclosure vulnerabilityEPSS 3.2%CVE-2017-4941—CVE-2017-4941EPSS 3.2%