Integer Underflow in VMware ESXi, Workstation and Fusion Affects Virtual Machine Security

CVE-2025-41237

What is CVE-2025-41237?

VMware ESXi, Workstation, and Fusion are affected by an integer underflow vulnerability within the Virtual Machine Communication Interface (VMCI). This flaw can allow a local attacker with administrative privileges on a virtual machine to perform an out-of-bounds write, potentially leading to arbitrary code execution in the VMX process on the host machine. In the case of ESXi, the impact is confined to the VMX sandbox; however, on Workstation and Fusion, the threat extends to the host system itself. Immediate action is recommended to secure affected installations.

References