Heap Overflow Vulnerability in VMware ESXi, Workstation, and Fusion Products

CVE-2025-41238

What is CVE-2025-41238?

VMware ESXi, Workstation, and Fusion exhibit a vulnerability within the PVSCSI (Paravirtualized SCSI) controller, which can lead to a heap overflow condition resulting in an out-of-bounds write. If a malicious actor gains local administrative access on a virtual machine, they may potentially exploit this flaw to execute arbitrary code within the VMX process running on the host machine. In the case of ESXi, any exploitation attempts are limited to the VMX sandbox, applicable only under specific unsupported configurations. On the other hand, vulnerabilities in Workstation and Fusion can permit an attacker to execute code on the host system where these applications are installed.

References