vSockets information-disclosure vulnerability

Description

VMware ESXi, Workstation, Fusion, and VMware Tools contains an information disclosure vulnerability due to the usage of an uninitialised memory in vSockets. A malicious actor with local administrative privileges on a virtual machine may be able to exploit this issue to leak memory from processes communicating with vSockets.

Scores

EPSS (exploitation in 30 days)

3.2% · top 12% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.1.

Weakness

• CWE-908 Use of Uninitialized Resource (opens in a new tab)All about CWE-908 and its CVEs

Affected products

• VMware · ESXi

  • affected 8.0 – < ESXi80U3f-24784735
  • affected 8.0 – < ESXi80U2e-24789317
  • affected 7.0 – < ESXi70U3w-24784741

• VMware · Cloud Foundation

  • affected 5.x, 4.5.x

• VMware · Workstation

  • affected 17.x – < 17.6.4

• VMware · Fusion

  • affected 13.x – < 13.6.4

• VMware · Telco Cloud Platform

  • affected 5.x, 4.x, 3.x, 2.x

• VMware · Telco Cloud Infrastructure

  • affected 3.x, 2.x

• VMware · Tools

  • affected 13.x.x – < 13.0.1.0
  • affected 12.x.x, 11.x.x, – < 12.5.3

References (1)

• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/35877 (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2025-41239](https://trackcve.app/badge/CVE-2025-41239.svg)](https://trackcve.app/cve/CVE-2025-41239)

Record last updated 15 Jul 2025, 18:51 UTC.