CVE-2025-41238
PVSCSI heap-overflow vulnerability
- Published
- Updated
- Reserved
- Assigned by
- vmware
Description
VMware ESXi, Workstation, and Fusion contain a heap-overflow vulnerability in the PVSCSI (Paravirtualized SCSI) controller that leads to an out of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox and exploitable only with configurations that are unsupported. On Workstation and Fusion, this may lead to code execution on the machine where Workstation or Fusion is installed.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| vmwareCNA (assigner) | 3.1 | Critical9.3 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| NVDNVD · Deferred | 3.1 | Critical9.3 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.46% · top 60% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.3.
Weakness
Affected products
- affected 8.0 – < ESXi80U3f-24784735
- affected 8.0 – < ESXi80U2e-24789317
- affected 7.0 – < ESXi70U3w-24784741
- affected 5.x, 4.5.x
- affected 17.x – < 17.6.4
- affected 13.x – < 13.6.4
- affected 5.x, 4.x, 3.x, 2.x
VMware · Telco Cloud Infrastructure
- affected 3.x, 2.x
References (1)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2025-41238)Record last updated .