CVE-2025-41236 — VMXNET3 integer-overflow vulnerability

Description (CNA)

VMware ESXi, Workstation, and Fusion contain an integer-overflow vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Non VMXNET3 virtual adapters are not affected by this issue.

Affected (CNA)

Vendor / product	Versions
VMware / ESXi	affected 8.0 before ESXi80U3f-24784735; affected 8.0 before ESXi80U2e-24789317; affected 7.0 before ESXi70U3w-24784741
VMware / Cloud Foundation	affected 5.x, 4.5.x
VMware / Workstation	affected 17.x before 17.6.4
VMware / Fusion	affected 13.x through 13.6.4
VMware / Telco Cloud Platform	affected 5.x, 4.x, 3.x, 2.x
VMware / Telco Cloud Infrastructure	affected 3.x, 2.x

CWE

CWE-787

References

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/35877

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.