CVE-2025-41236
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-07-15

Last updated on: 2025-07-15

Assigner: VMware

Description
VMware ESXi, Workstation, and Fusion contain an integer-overflow vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Non VMXNET3 virtual adapters are not affected by this issue.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-07-15
Last Modified
2025-07-15
Generated
2026-05-27
AI Q&A
2025-07-15
EPSS Evaluated
2026-05-25
NVD
CVE-2025-41236
EUVD
EUVD-2025-21544
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
vmware vmxnet3 *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability is an integer-overflow issue in the VMXNET3 virtual network adapter used by VMware ESXi, Workstation, and Fusion. A malicious actor who has local administrative privileges on a virtual machine with the VMXNET3 adapter can exploit this flaw to execute code on the host system. Other virtual network adapters are not affected.


How can this vulnerability impact me? :

If exploited, this vulnerability allows an attacker with local admin access on a VM to execute code on the host machine, potentially compromising the host system's security, leading to unauthorized control, data breaches, or disruption of services.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart