CVE-2025-41236: 
VMware Workstation vulnerability analysis and mitigation

CVE-2025-41236 is a critical integer-overflow vulnerability in the VMXNET3 virtual network adapter affecting VMware ESXi, Workstation, and Fusion. Disclosed on July 15, 2025, as part of Broadcom security advisory VMSA-2025-0013, it was discovered and reported by Nguyen Hoang Thach (@hi_im_d4rkn3ss) of STARLabs SG during the Pwn2Own Berlin 2025 competition. Affected versions include ESXi 7.0 (before ESXi70U3w-24784741), ESXi 8.0 (before ESXi80U3f-24784735 and ESXi80U2e-24789317), Workstation 17.x (before 17.6.4), and Fusion 13.x (before 13.6.4); non-VMXNET3 virtual adapters are not affected. It carries a CVSS v3.1 base score of 9.3 (Critical) (Broadcom Advisory, ZDI Advisory).

The vulnerability is classified as CWE-787 (Out-of-bounds Write), triggered by an integer overflow in the VMXNET3 virtual network adapter's processing logic within VMware's hypervisor stack. An integer overflow condition causes a subsequent out-of-bounds write, which can be leveraged to corrupt memory in the host's VMX process. The attack vector is local, requiring an attacker to have local administrative privileges inside a guest virtual machine configured with a VMXNET3 adapter — no user interaction or network access is required. The vulnerability was demonstrated at Pwn2Own Berlin 2025, confirming practical exploitability in a controlled environment (Broadcom Advisory, ZDI Advisory).

Successful exploitation allows a malicious actor with local administrative privileges inside a guest VM to execute arbitrary code on the underlying host system, achieving a full virtual machine escape. This results in high impact to confidentiality, integrity, and availability of the host, with a changed scope (S:C) indicating that the compromise extends beyond the guest VM boundary. An attacker who escapes the VM could potentially pivot to other VMs on the same host, access sensitive host-level data, or disrupt hypervisor operations across the entire virtualization infrastructure (Broadcom Advisory, Qualys ThreatProtect).

The vulnerability was exploited live at Pwn2Own Berlin 2025, confirming real-world exploitability, though no public proof-of-concept exploit code has been released as of the time of reporting. The Zero Day Initiative published an advisory (ZDI-26-189) in March 2026 following the standard disclosure timeline. No evidence of in-the-wild exploitation outside of the competition context has been reported, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017%, reflecting low but non-zero probability of near-term exploitation (ZDI Advisory, Broadcom Advisory). Shadowserver reported approximately 17,000 VMware ESXi servers remained unpatched weeks after disclosure, highlighting significant exposure (SecurityWeek).

1. Gain guest VM access: Obtain local administrative (root/Administrator) privileges inside a guest virtual machine that is configured with a VMXNET3 virtual network adapter on a vulnerable VMware ESXi, Workstation, or Fusion host.
2. Identify VMXNET3 adapter: Confirm the VM is using a VMXNET3 adapter (not E1000 or VMXNET2), as only VMXNET3 is affected by this vulnerability.
3. Trigger integer overflow: Craft and send specially crafted network adapter control commands or I/O operations targeting the VMXNET3 driver's processing logic to trigger an integer overflow condition in the host's VMX process.
4. Achieve out-of-bounds write: The integer overflow causes a miscalculated buffer size, resulting in an out-of-bounds write that corrupts host memory in the VMX process context.
5. Execute code on host: Leverage the memory corruption to redirect execution flow and run arbitrary code on the hypervisor host, effectively escaping the VM sandbox and gaining host-level code execution (Broadcom Advisory, ZDI Advisory).

• Process: Unexpected child processes spawned by the VMX process (vmware-vmx) on the ESXi host or Workstation/Fusion host, such as shell interpreters or network utilities.
• Logs: Unusual VMX process crashes or restarts logged in /var/log/vmkernel.log or vmware.log within the VM's working directory; memory fault or segmentation fault entries associated with VMXNET3 device emulation.
• Network: Anomalous outbound connections originating from the ESXi host management interface or VMX process to external IPs, particularly following guest VM activity.
• File System: Unexpected files written to host filesystem paths accessible by the VMX process; new or modified files in ESXi's /tmp or /scratch directories created around the time of suspicious guest activity.
• Behavioral: Guest VMs with VMXNET3 adapters generating abnormal volumes of network adapter I/O or control-plane requests detectable via hypervisor performance counters (Broadcom Advisory).

Broadcom has released patches addressing CVE-2025-41236 with no available workarounds — patching is the only remediation. Apply the following fixed versions: ESXi 8.0 → ESXi80U3f-24784735 or ESXi80U2e-24789317; ESXi 7.0 → ESXi70U3w-24784741; Workstation 17.x → 17.6.4; Fusion 13.x → 13.6.4; Cloud Foundation 5.x → async patch to ESXi80U3f-24784735; Cloud Foundation 4.5.x → async patch to ESXi70U3w-24784741. As an interim measure where patching is not immediately possible, consider restricting local administrative access to guest VMs, implementing network segmentation, and temporarily replacing VMXNET3 adapters with non-affected adapter types (Broadcom Advisory).

The vulnerability received significant attention given its Pwn2Own Berlin 2025 origin, with researchers earning $340,000 in prizes for VMware-related exploits at the event (SecurityWeek). BleepingComputer and SecurityAffairs covered the patches as part of a broader story on four ESXi zero-days fixed simultaneously (BleepingComputer). Multiple national CERTs — including Canada (CCCS), Singapore (CSA), Hong Kong (GovCERT), Belgium (CCB), and ENISA/CERT-EU — issued advisories urging immediate patching. Heise.de reported weeks after disclosure that administrators were failing to apply the critical patches, with Shadowserver identifying approximately 17,000 still-vulnerable ESXi servers publicly exposed (Heise). Reddit communities (r/vmware, r/sysadmin) actively discussed the advisory with urgency.