VMSA-2025-0013: VMware ESXi, Workstation, Fusion, and Tools updates address multiple vulnerabilities (CVE-2025-41236, CVE-2025-41237, CVE-2025-41238, CVE-2025-41239)

Created on 2025-07-16 12:20, updated on 2025-07-16 12:20, by Alexandre Dulaunoy
JSON
Description

Support Content Notification - Support Portal - Broadcom support portal

Ref: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/35877 * Advisory ID: : Advisory Severity: * VMSA-2025-0013: Critical * Advisory ID: : CVSSv3 Range: * VMSA-2025-0013: 6.2-9.3 * Advisory ID: : Synopsis: * VMSA-2025-0013: VMware ESXi, Workstation, Fusion, and Tools updates address multiple vulnerabilities (CVE-2025-41236, CVE-2025-41237, CVE-2025-41238, CVE-2025-41239) * Advisory ID: : Issue date: * VMSA-2025-0013: 2025-07-15 * Advisory ID: : Updated on: * VMSA-2025-0013: 2025-07-15 (Initial Advisory) * Advisory ID: : CVE(s) * VMSA-2025-0013: CVE-2025-41236, CVE-2025-41237, CVE-2025-41238, CVE-2025-41239

1. Impacted Products

  • VMware Cloud Foundation
  • VMware vSphere Foundation
  • VMware ESXi
  • VMware Workstation Pro 
  • VMware Fusion 
  • VMware Tools
  • VMware Telco Cloud Platform
  • VMware Telco Cloud Infrastructure

2. Introduction

Multiple vulnerabilities in VMware ESXi, Workstation, Fusion, and Tools were privately reported to Broadcom. Updates are available to remediate these vulnerabilities in affected Broadcom products. 

3a. VMXNET3 integer-overflow vulnerability (CVE-2025-41236)

Description: VMware ESXi, Workstation, and Fusion contain an integer-overflow vulnerability in the VMXNET3 virtual network adapter. Broadcom has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.3.

Known Attack Vectors:
A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Non VMXNET3 virtual adapters are not affected by this issue.

Resolution: To remediate CVE-2025-41236 apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' found below.

Workarounds:
None

Additional Documentation:
A supplemental FAQ was created for clarification. Please see: https://brcm.tech/vmsa-2025-0013-qna.

Acknowledgments: Broadcom would like to thank Nguyen Hoang Thach (@hi_im_d4rkn3ss) of STARLabs SG working with the Pwn2Own held by Zero day initiative for reporting this issue to us.

Notes:
None.

3b. VMCI integer-underflow vulnerability (CVE-2025-41237)

Description: VMware ESXi, contain an integer-underflow in VMCI (Virtual Machine Communication Interface) that leads to an out-of-bounds write. Broadcom has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.3.

Known Attack Vectors:
A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox whereas, on Workstation and Fusion, this may lead to code execution on the machine where Workstation or Fusion is installed.

Resolution: To remediate CVE-2025-41237 apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' found below.

Workarounds:
None

Additional Documentation:
A supplemental FAQ was created for clarification. Please see: https://brcm.tech/vmsa-2025-0013-qna.

Acknowledgments: Broadcom would like to thank Corentin BAYET (@OnlyTheDuck) of REverse Tactics (@Reverse_Tactics) working with the Pwn2Own held by Zero day initiative for reporting this issue to us.

Notes:
None

3c. PVSCSI heap-overflow vulnerability (CVE-2025-41238)

Description: VMware ESXi, Workstation, and Fusion contain a heap-overflow vulnerability in the PVSCSI (Paravirtualized SCSI) controller that leads to an out of-bounds write. Broadcom has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.3.

Known Attack Vectors:
A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox and exploitable only with configurations that are unsupported. On Workstation and Fusion, this may lead to code execution on the machine where Workstation or Fusion is installed.

Resolution: To remediate CVE-2025-41238 apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' found below.

Workarounds:
None

Additional Documentation:
A supplemental FAQ was created for clarification. Please see: https://brcm.tech/vmsa-2025-0013-qna.

Acknowledgments: Broadcom would like to thank Thomas Bouzerar (@MajorTomSec) and Etienne Helluy-Lafont of Synacktiv working with the Pwn2Own held by Zero day initiative for reporting this issue to us.

Notes:
None.

3d. vSockets information-disclosure vulnerability (CVE-2025-41239)

Description: VMware ESXi, Workstation, Fusion, and VMware Tools contains an information disclosure vulnerability due to the usage of an uninitialised memory in vSockets. Broadcom has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.1.

Known Attack Vectors:
A malicious actor with local administrative privileges on a virtual machine may be able to exploit this issue to leak memory from processes communicating with vSockets.

Resolution:
To remediate CVE-2025-41239 apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' found below.

Workarounds:
None

Additional Documentation:
A supplemental FAQ was created for clarification. Please see: https://brcm.tech/vmsa-2025-0013-qna.

Acknowledgments: Broadcom would like to thank Corentin BAYET (@OnlyTheDuck) of REverse Tactics (@Reverse_Tactics) working with the Pwn2Own held by Zero day initiative and Gwangun Jung of THEORI working with Trend Micro Zero Day Initiative for independently reporting this issue to us.

Notes:
[1] CVE-2025-41239 affects VMware Tools for Windows. Please check the FAQ for additional guidance if you are running VMware Tools for Windows.  
[2] VMware Tools 12.4.8 which is part of VMware Tools 12.5.3, also addresses the issue for Windows 32-bit.

Response Matrix: 

  • VMware Product: VMware Cloud Foundation,VMware vSphere Foundation
  • Component: ESX
  • Version: 9.0.0.0
  • Running On: Any
  • CVE: CVE-2025-41236, CVE-2025-41238, CVE-2025-41239
  • CVSSv3: N/A
  • Severity: N/A
  • Fixed Version: Unaffected
  • Workarounds: N/A
  • Additional Documentation: N/A
  • VMware Product: ESX
  • Component: 9.0.0.0
  • Version: Any
  • Running On: CVE-2025-41237
  • CVE: 8.4
  • CVSSv3: Important
  • Severity: ESXi-9.0.0.0100-24813472
  • Fixed Version: None
  • Workarounds: Additional guidance for updating VMware Tools asynchronously is available in the FAQ.
  • Additional Documentation:
  • VMware Product: VMware Tools [1]
  • Component: 13.0.0.0
  • Version: Windows
  • Running On: CVE-2025-41239
  • CVE: 6.2
  • CVSSv3: Moderate
  • Severity: 13.0.1.0
  • Fixed Version: None
  • Workarounds: FAQ
  • Additional Documentation:
  • VMware Product: VMware ESXi
  • Component: N/A
  • Version: 8.0
  • Running On: Any
  • CVE: CVE-2025-41236, CVE-2025-41237, CVE-2025-41238, CVE-2025-41239
  • CVSSv3: 9.3, 8.4, 7.4, 7.1
  • Severity: Critical
  • Fixed Version: ESXi80U3f-24784735
  • Workarounds: None
  • Additional Documentation: Additional guidance for updating VMware Tools asynchronously is available in the FAQ.
  • VMware Product: VMware ESXi
  • Component: N/A
  • Version: 8.0
  • Running On: Any
  • CVE: CVE-2025-41236, CVE-2025-41237, CVE-2025-41238, CVE-2025-41239
  • CVSSv3: 9.3, 8.4, 7.4, 7.1
  • Severity: Critical
  • Fixed Version: ESXi80U2e-24789317
  • Workarounds: None
  • Additional Documentation: Additional guidance for updating VMware Tools asynchronously is available in the FAQ.
  • VMware Product: VMware ESXi
  • Component: N/A
  • Version: 7.0 
  • Running On: Any
  • CVE: CVE-2025-41236, CVE-2025-41237, CVE-2025-41238, CVE-2025-41239
  • CVSSv3: 9.3, 8.4, 7.4, 7.1
  • Severity: Critical
  • Fixed Version: ESXi70U3w-24784741
  • Workarounds: None
  • Additional Documentation: Additional guidance for updating VMware Tools asynchronously is available in the FAQ.
  • VMware Product: VMware Workstation
  • Component: N/A
  • Version: 17.x
  • Running On: Any
  • CVE: CVE-2025-41236, CVE-2025-41237, CVE-2025-41238, CVE-2025-41239
  • CVSSv3: 9.3, 9.3, 9.3, 7.1
  • Severity: Critical
  • Fixed Version: 17.6.4
  • Workarounds: None
  • Additional Documentation: FAQ
  • VMware Product: VMware Fusion
  • Component: N/A
  • Version: 13.x
  • Running On: Any
  • CVE: CVE-2025-41236, CVE-2025-41237, CVE-2025-41238, CVE-2025-41239
  • CVSSv3: 9.3, 9.3, 9.3, 7.1
  • Severity: Critical
  • Fixed Version: 13.6.4
  • Workarounds: None
  • Additional Documentation: FAQ
  • VMware Product: VMware Cloud Foundation 
  • Component: N/A
  • Version: 5.x
  • Running On: Any
  • CVE: CVE-2025-41236, CVE-2025-41237, CVE-2025-41238, CVE-2025-41239
  • CVSSv3: 9.3, 8.4, 7.4, 7.1
  • Severity: Critical
  • Fixed Version: Async patch to ESXi80U3f-24784735
  • Workarounds: None
  • Additional Documentation: Async Patching Guide:
  • VMware Product: VMware Cloud Foundation 
  • Component: N/A
  • Version: 4.5.x
  • Running On: Any
  • CVE: CVE-2025-41236, CVE-2025-41237, CVE-2025-41238, CVE-2025-41239
  • CVSSv3: 9.3, 8.4, 7.4, 7.1
  • Severity: Critical
  • Fixed Version: Async patch to ESXi70U3w-24784741
  • Workarounds: None
  • Additional Documentation: Async Patching Guide: KB88287
  • VMware Product: VMware Telco Cloud Platform
  • Component: N/A
  • Version: 5.x, 4.x
  • Running On: Any
  • CVE: CVE-2025-41236, CVE-2025-41237, CVE-2025-41238, CVE-2025-41239
  • CVSSv3: 9.3, 8.4, 7.4, 7.1
  • Severity: Critical
  • Fixed Version: ESXi80U3f-24784735
  • Workarounds: None
  • Additional Documentation: FAQ
  • VMware Product: VMware Telco Cloud Platform
  • Component: N/A
  • Version: 3.x, 2.x
  • Running On: Any
  • CVE: CVE-2025-41236, CVE-2025-41237, CVE-2025-41238, CVE-2025-41239
  • CVSSv3: 9.3, 8.4, 7.4, 7.1
  • Severity: Critical
  • Fixed Version: ESXi70U3w-24784741
  • Workarounds: None
  • Additional Documentation: FAQ
  • VMware Product: VMware Telco Cloud Infrastructure
  • Component: N/A
  • Version: 3.x, 2.x 
  • Running On: Any
  • CVE: CVE-2025-41236, CVE-2025-41237, CVE-2025-41238, CVE-2025-41239
  • CVSSv3: 9.3, 8.4, 7.4, 7.1
  • Severity: Critical
  • Fixed Version: ESXi70U3w-24784741
  • Workarounds:  
  • Additional Documentation: FAQ
  • VMware Product: VMware Tools [1]
  • Component: N/A
  • Version: 13.x.x
  • Running On: Windows
  • CVE: CVE-2025-41239
  • CVSSv3: 6.2
  • Severity: Moderate
  • Fixed Version:  13.0.1.0
  • Workarounds: None
  • Additional Documentation: FAQ
  • VMware Product: VMware Tools [1]
  • Component: N/A
  • Version: 12.x.x, 11.x.x
  • Running On: Windows
  • CVE: CVE-2025-41239
  • CVSSv3: 6.2
  • Severity: Moderate
  • Fixed Version:  12.5.3 [2]
  • Workarounds: None
  • Additional Documentation: FAQ 
  • VMware Product: VMware Tools
  • Component: N/A
  • Version: 13.x.x, 12.x.x, 11.x.x
  • Running On: Linux
  • CVE: CVE-2025-41239
  • CVSSv3: N/A
  • Severity: N/A
  • Fixed Version: Unaffected
  • Workarounds: N/A
  • Additional Documentation: N/A
  • VMware Product: VMware Tools
  • Component: N/A
  • Version: 13.x.x, 12.x.x, 11.x.x
  • Running On: macOS
  • CVE: CVE-2025-41239
  • CVSSv3: N/A
  • Severity: N/A
  • Fixed Version: Unaffected
  • Workarounds: N/A
  • Additional Documentation: N/A

4. References

VMware Cloud Foundation 9.0.0.0.0
Downloads and Documentation:
https://support.broadcom.com/group/ecx/productfiles?displayGroup=VMware%20Cloud%20Foundation%209&release=9.0.0.0&os=&servicePk=&language=EN&groupId=529537&viewGroup=true

VMware vSphere Foundation 9.0.0.0.0
Downloads and Documentation:
https://support.broadcom.com/group/ecx/productfiles?displayGroup=VMware%20vSphere%20Foundation%209&release=9.0.0.0&os=&servicePk=&language=EN&groupId=529542&viewGroup=true

VMware ESXi 8.0 ESXi80U3f-24784735
Downloads and Documentation:
https://support.broadcom.com/web/ecx/solutiondetails?patchId=15938
https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere/8-0/release-notes/esxi-update-and-patch-release-notes/vsphere-esxi-80u3f-release-notes.html

VMware ESXi 8.0 ESXi80U2e-24789317
Downloads and Documentation:
https://support.broadcom.com/web/ecx/solutiondetails?patchId=15939
https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere/8-0/release-notes/esxi-update-and-patch-release-notes/vsphere-esxi-80u2e-release-notes.html

VMware ESXi 7.0 ESXi70U3w-24784741
Downloads and Documentation:
https://support.broadcom.com/web/ecx/solutiondetails?patchId=15940
https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere/7-0/release-notes/esxi-update-and-patch-release-notes/vsphere-esxi-70u3w-release-notes.html

VMware Workstation 17.6.4
Downloads and Documentation:
https://support.broadcom.com/group/ecx/productdownloads?subfamily=VMware%20Workstation%20Pro&freeDownloads=true
https://techdocs.broadcom.com/us/en/vmware-cis/desktop-hypervisors/workstation-pro/17-0/release-notes/vmware-workstation-1764-pro-release-notes.html

VMware Tools 13.0.1.0
Downloads and Documentation:
https://support.broadcom.com/group/ecx/productfiles?subFamily=VMware%20Tools&displayGroup=VMware%20Tools%2013.x&release=13.0.1.0&os=&servicePk=&language=EN&freeDownloads=true
https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/tools/13-0-0/release-notes/vmware-tools-1301-release-notes.html

VMware Tools 12.5.3
Downloads and Documentation:
https://support.broadcom.com/group/ecx/productfiles?subFamily=VMware%20Tools&displayGroup=VMware%20Tools%2012.x&release=12.5.3&os=&servicePk=&language=EN&freeDownloads=true
https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/tools/12-5-0/release-notes/vmware-tools-1253-release-notes.html

Mitre CVE Dictionary Links:
https://www.cve.org/CVERecord?id=CVE-2025-41236 
https://www.cve.org/CVERecord?id=CVE-2025-41237 
https://www.cve.org/CVERecord?id=CVE-2025-41238 
https://www.cve.org/CVERecord?id=CVE-2025-41239 

FIRST CVSSv3 Calculator:
CVE-2025-41236: https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVE-2025-41237:
ESXi: https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWorkstation/Fusion: https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVE-2025-41238: 
ESXi: https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HWorkstation/Fusion: https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVE-2025-41239:
ESXi/Workstation/Fusion: https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Tools: https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

5. Change Log:

2025-07-15 VMSA-2025-0013
Initial security advisory.

6. Contact:

Copyright 2025 Broadcom. All rights reserved.

Vulnerabilities included in this bundle
Combined detection rules

Detection rules are retrieved from Rulezet.

Combined sightings
Author Vulnerability Source Type Date