Note: This data is for reference and cybersecurity research purposes only.CyStack advises users not to use this information for unlawful purposes.
CVE-2025-41236 is a vulnerability classified as Out-of-bounds Write, affecting ESXi (affected versions: 8.0 – < ESXi80U3f-24784735, 8.0 – < ESXi80U2e-24789317, and other affected versions), Cloud Foundation (affected versions: 5.x, 4.5.x), Workstation (affected versions: 17.x – < 17.6.4), and 3 more products. This vulnerability is rated Critical, with a CVSS score of 9.3. Current sources do not report this vulnerability as exploited.
VMware ESXi, Workstation, and Fusion contain an integer-overflow vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Non VMXNET3 virtual adapters are not affected by this issue.
ESXi80U3f-24784735 or below ESXi80U2e-24789317, depending on the update branch in use. Broadcom lists these builds as the applicable remediation points.ESXi70U3w-24784741.17.6.4; Broadcom lists 17.6.4 as the fixed version.13.6.4 as affected, while Broadcom's response matrix lists 13.6.4 as fixed. This is a source discrepancy, so release status should be confirmed with the vendor before treating 13.6.4 as remediated.5.x and 4.5.x are affected. Broadcom specifies an asynchronous patch to ESXi80U3f-24784735 for 5.x and to ESXi70U3w-24784741 for 4.5.x.5.x and 4.x map to the ESXi80U3f-24784735 remediation point; 3.x and 2.x map to ESXi70U3w-24784741.3.x and 2.x map to ESXi70U3w-24784741.The flaw is in the VMXNET3 virtual network adapter used by VMware ESXi, Workstation, and Fusion. It is described as an integer overflow and classified as CWE-787, an out-of-bounds write. The record and vendor advisory do not disclose the exact arithmetic operation, input field, or internal code path that produces the unsafe write, so the implementation detail remains unknown.
The vendor states that exploitation requires local administrative privileges on a virtual machine using VMXNET3. The confirmed outcome is code execution on the host, crossing the guest to host isolation boundary. Non-VMXNET3 virtual adapters are not affected according to the vendor description. The supplied scoring metadata labels the attack vector as local, complexity as low, and user interaction as none, but separately lists privileges required as none, while the vendor attack-vector description explicitly requires local administrative privileges inside the VM. Use the vendor precondition for deployment checks and treat this difference as an interpretation caveat.
The vulnerability is reachable from inside a virtual machine rather than through a direct external network request to the host. Broadcom describes the precondition as local administrative privileges on a VM configured with the VMXNET3 adapter; the supplied metadata describes low complexity and no user interaction.
The supplied record marks public_exploit as false and leaves known_exploited unset. The CISA enrichment returned with the record also marked exploitation as none in its assessment. These statuses do not prove that exploitation cannot occur later. Broadcom states that the vulnerabilities in the advisory were privately reported, but the available evidence does not confirm a public exploit or a specific exploitation campaign for this vulnerability.
The confirmed technical outcome is host code execution from a VM using VMXNET3 when the attacker meets the local access condition described by the vendor. The impact therefore crosses from one guest to the host and may affect other workloads sharing that host.
Possible consequences include loss of host integrity, service disruption, or unauthorized access to resources managed by the host. These are plausible consequences of host code execution, not specific post-exploitation actions demonstrated in the record. The available evidence does not describe a payload, detailed exploit sequence, persistence mechanism, or the level of host control obtained after exploitation.
Successful exploitation may allow attacker-controlled code to run on the host, potentially affecting the confidentiality, integrity, or availability of the host and other VMs running there. This is particularly important where VM isolation is relied on to separate workloads or tenants.
The evidence establishes host code execution, but it does not establish a specific persistence method, lateral movement path, data theft scenario, or breach. The practical impact will depend on host privileges, management configuration, and the workloads colocated on the affected host.
ESXi80U3f-24784735 or ESXi80U2e-24789317, and update ESXi 7.0 to ESXi70U3w-24784741.17.6.4 as listed in Broadcom's response matrix.13.6.4 as fixed, but the normalized affected data marks 13.6.4 as affected. Confirm the vendor's release status and verify the installed build before closing remediation.ESXi80U3f-24784735 for the 5.x branch or to ESXi70U3w-24784741 for the 4.5.x branch, following Broadcom's update guidance.affected_summary and verify the mapping between the managed product and its underlying ESXi release.VMXNET3 adapter, which is the key exposure condition stated by the vendor. VMs using other virtual adapters are described as unaffected by this issue.affected_summary, and check asynchronous patch status for Cloud Foundation and Telco Cloud deployments.CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
en
