What’s Vulnerable › Vulnerabilities
CVE-2025-41236: VMXNET3 integer-overflow vulnerability
- Severity: critical (CVSS 9.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 2.6% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-07-15 · updated 2026-06-17
- Weakness: CWE-787
Description
VMware ESXi, Workstation, and Fusion contain an integer-overflow vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Non VMXNET3 virtual adapters are not affected by this issue.
Affected products
- VMware Cloud Foundation: 5.x, 4.5.x
- VMware ESXi: from 8.0 before ESXi80U3f-24784735; from 8.0 before ESXi80U2e-24789317; from 7.0 before ESXi70U3w-24784741 — fixed in ESXi70U3w-24784741, ESXi80U2e-24789317, ESXi80U3f-24784735
- VMware Fusion: from 13.x through 13.6.4
- VMware Telco Cloud Infrastructure: 3.x, 2.x
- VMware Telco Cloud Platform: 5.x, 4.x, 3.x, 2.x
- VMware Workstation: from 17.x before 17.6.4 — fixed in 17.6.4
How to fix
Upgrade to a fixed version: VMware ESXi ESXi70U3w-24784741, ESXi80U2e-24789317, ESXi80U3f-24784735; VMware Workstation 17.6.4. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-41236 or the next vulnerability affects your stack