We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

THREATINT
PUBLISHED

CVE-2025-41236

VMXNET3 integer-overflow vulnerability



Description

VMware ESXi, Workstation, and Fusion contain an integer-overflow vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Non VMXNET3 virtual adapters are not affected by this issue.

Reserved 2025-04-16 | Published 2025-07-15 | Updated 2025-07-15 | Assigner vmware


CRITICAL: 9.3CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Problem types

CWE-787 Out-of-bounds Write

Product status

Default status
unaffected

8.0 before ESXi80U3f-24784735
affected

8.0 before ESXi80U2e-24789317
affected

7.0 before ESXi70U3w-24784741
affected

Default status
unaffected

5.x, 4.5.x
affected

Default status
unaffected

17.x before 17.6.4
affected

Default status
unaffected

13.x
affected

Default status
unaffected

5.x, 4.x, 3.x, 2.x
affected

Default status
unaffected

3.x, 2.x
affected

References

support.broadcom.com/...l/content/SecurityAdvisories/0/35877

cve.org (CVE-2025-41236)

nvd.nist.gov (CVE-2025-41236)

Download JSON

Share this page
https://cve.threatint.eu/CVE/CVE-2025-41236

Support options

Helpdesk Chat, Email, Knowledgebase
© Copyright 2025 THREATINT
Made in Cyprus with ❤ + ☼
 System status
Find us on
Data Privacy
Terms of Use
Logo BSI Allianz für Cyber-Sicherheit
Error loading Crisp.chat. Please check your web content filter and browser plugins.