VMSA-2025-0013 – VMware ESXi, Workstation, Fusion, and Tools – Multiple Vulnerabilities

VMware by Broadcom has released VMware ESXi, Workstation, Fusion, and Tools updates to address multiple vulnerabilities CVE-2025-41236, CVE-2025-41237, CVE-2025-41238, CVE-2025-41239. Multiple vulnerabilities in VMware ESXi, Workstation, Fusion, and Tools were privately reported to Broadcom. Updates are available to remediate these vulnerabilities in affected Broadcom products. 

Impacted Products

• VMware Cloud Foundation
• VMware vSphere Foundation
• VMware ESXi
• VMware Workstation Pro
• VMware Fusion 
• VMware Tools
• VMware Telco Cloud Platform
• VMware Telco Cloud Infrastructure

CVE-2025-41236 | VMXNET3 integer-overflow vulnerability 

Description: 
VMware ESXi, Workstation, and Fusion contain an integer-overflow vulnerability in the VMXNET3 virtual network adapter. Broadcom has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.3. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Non VMXNET3 virtual adapters are not affected by this issue.

Resolution: 
To remediate CVE-2025-41236 apply the patches listed in the ‘Fixed Version’ column of the ‘Response Matrix’ found below.

CVE-2025-41237 | VMCI integer-underflow vulnerability

Description: 
VMware ESXi, Workstation, and Fusion contain an integer-underflow in VMCI (Virtual Machine Communication Interface) that leads to an out-of-bounds write. Broadcom has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.3. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine’s VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox whereas, on Workstation and Fusion, this may lead to code execution on the machine where Workstation or Fusion is installed.
Resolution: 
To remediate CVE-2025-41237 apply the patches listed in the ‘Fixed Version’ column of the ‘Response Matrix’ found below.

CVE-2025-41238 | PVSCSI heap-overflow vulnerability

Description: 
VMware ESXi, Workstation, and Fusion contain a heap-overflow vulnerability in the PVSCSI (Paravirtualized SCSI) controller that leads to an out of-bounds write. Broadcom has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.3. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine’s VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox and exploitable only with configurations that are unsupported. On Workstation and Fusion, this may lead to code execution on the machine where Workstation or Fusion is installed.

Resolution: 
To remediate CVE-2025-41238 apply the patches listed in the ‘Fixed Version’ column of the ‘Response Matrix’ found below.

CVE-2025-41239 | vSockets information-disclosure vulnerability

Description: 
VMware ESXi, Workstation, Fusion, and VMware Tools contains an information disclosure vulnerability due to the usage of an uninitialised memory in vSockets. Broadcom has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.1. A malicious actor with local administrative privileges on a virtual machine may be able to exploit this issue to leak memory from processes communicating with vSockets.

Resolution:
To remediate CVE-2025-41239 apply the patches listed in the ‘Fixed Version’ column of the ‘Response Matrix’ found below.

Response Matrix: 

You can also check my VMware Product Release page for more information regarding released products, release notes, and download links.

Sources:
Broadcom Blog Post