VMXNET3 integer-overflow vulnerability_CVE-2025-41236

9.3 / 10

CRITICAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Description

VMware ESXi, Workstation, and Fusion contain an integer-overflow vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Non VMXNET3 virtual adapters are not affected by this issue.

Basic Information

ID CVE-2025-41236

Source vmware

Published Jul 15, 2025 at 18:34

Modified Jul 16, 2025 at 03:55

Affected Product

Vendor VMware

Product ESXi

Version 8.0

Affected Versions VMware ESXi 8.0
VMware ESXi 8.0
VMware ESXi 7.0
VMware Cloud Foundation 5.x, 4.5.x
VMware Workstation 17.x
VMware Fusion 13.x
VMware Telco Cloud Platform 5.x, 4.x, 3.x, 2.x
VMware Telco Cloud Infrastructure 3.x, 2.x

CWE Classification

CWE-787

References

support.broadcom.com /web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/35877

{
    "lastseen": "",
    "description": "VMware ESXi, Workstation, and Fusion contain an integer-overflow vulnerability in the VMXNET3 virtual network adapter.\u00a0A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Non VMXNET3 virtual adapters are not affected by this issue.",
    "published": "2025-07-15T18:34:12.719Z",
    "modified": "2025-07-16T03:55:58.257Z",
    "type": "cve",
    "title": "VMXNET3 integer-overflow vulnerability",
    "source": "vmware",
    "references": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/35877",
    "id": "CVE-2025-41236",
    "bulletinFamily": "",
    "cwe": [
        "CWE-787"
    ],
    "cvelist": null,
    "sourceData": "VMware ESXi 8.0\nVMware ESXi 8.0\nVMware ESXi 7.0\nVMware Cloud Foundation 5.x, 4.5.x\nVMware Workstation 17.x\nVMware Fusion 13.x\nVMware Telco Cloud Platform 5.x, 4.x, 3.x, 2.x\nVMware Telco Cloud Infrastructure 3.x, 2.x",
    "sourceHref": "",
    "cvss": {
        "score": 9.3,
        "severity": "CRITICAL",
        "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
        "version": "3.1"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "ESXi",
    "version": "8.0",
    "vendor": "VMware",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}