CVE-2025-41237: VMware VMCI integer-underflow vulnerability
This VMware advisory covers CVE-2025-41237 in Cloud Foundation, vSphere Foundation and ESXi.
- CVE-2025-41237
Key facts
- Vendor rating
- Critical, CVSS 9.3
- CISA KEV
- Not listed (catalogue checked )
- Affected
- Cloud Foundation 9.0.0.0, 5.x, 4.5.x; vSphere Foundation 9.0.0.0; ESXi 8.0 before ESXi80U3f-24784735 and 6 more below
- Fixed in
- ESXi80U3f-24784735, ESXi80U2e-24789317, ESXi70U3w-24784741 and 2 more below
- Source published
- Source revised
- Listed by VulniPulse
Compiled by VulniPulse from the linked sources. How records are collected and checked.
Affected products & platforms
Description
VMware ESXi, Workstation, and Fusion contain an integer-underflow in VMCI (Virtual Machine Communication Interface) that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.
On ESXi, the exploitation is contained within the VMX sandbox whereas, on Workstation and Fusion, this may lead to code execution on the machine where Workstation or Fusion is installed.
Affected products named by the advisory: Cloud Foundation; vSphere Foundation.
Text from the source record.
- Cloud Foundation 9.0.0.0, 5.x, 4.5.x
- vSphere Foundation 9.0.0.0
- ESXi 8.0 before ESXi80U3f-24784735
- ESXi 8.0 before ESXi80U2e-24789317
- ESXi 7.0 before ESXi70U3w-24784741
- Workstation 17.x before 17.6.4
- Fusion 13.x before 13.6.4
- Telco Cloud Platform 5.x, 4.x, 3.x, 2.x
- Telco Cloud Infrastructure 3.x, 2.x
Official advisory · high-confidence parse· fetched ·verify at source
How to fix CVE-2025-41237
Upgrade to a fixed release named by VMware:
- ESXi80U3f-24784735
- ESXi80U2e-24789317
- ESXi70U3w-24784741
- 17.6.4
- 13.6.4
End-of-life dates for VMware ESXi
More VMware (Broadcom) advisories
CVE-2026-41703Jul 30, 2026Out-of-bounds read vulnerabilityCVE-2026-41709Jul 30, 2026ESX insufficient logging vulnerabilityCVE-2026-47876Jul 30, 2026VMXNET3 out-of-bounds write vulnerabilityCVE-2026-59309Jul 30, 2026vCenter: VMware vCenter authentication bypassCVE-2026-59310Jul 30, 2026vCenter directory-traversal vulnerabilityCVE-2026-41012Aug 29, 2026BOSH: Traffic interception vulnerability in BOSH Director vCenter CPI
VMware (Broadcom) advisories, July 2025All VMware (Broadcom) advisories
Get an email when VMware ESXi / vSphere publishes the next one.
See VMware ESXi / vSphere's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor future VMware (Broadcom) CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
