CVE-2025-41238: 
VMware Workstation vulnerability analysis and mitigation

CVE-2025-41238 is a heap-overflow vulnerability in the PVSCSI (Paravirtualized SCSI) controller of VMware ESXi, Workstation, and Fusion that leads to an out-of-bounds write (CWE-787). A malicious actor with local administrative privileges on a virtual machine can exploit this issue to execute code as the VMX process running on the host. Affected products include VMware ESXi 7.0 (before ESXi70U3w-24784741), ESXi 8.0 (before ESXi80U3f-24784735 or ESXi80U2e-24789317), Workstation 17.x (before 17.6.4), Fusion 13.x (before 13.6.4), and associated Cloud Foundation and Telco Cloud products. The vulnerability was disclosed on July 15, 2025, and was discovered by Thomas Bouzerar (@MajorTomSec) and Etienne Helluy-Lafont of Synacktiv, who demonstrated it at Pwn2Own Berlin 2025. It carries a CVSS v3.1 base score of 9.3 (Critical) for Workstation/Fusion, and a lower score for ESXi due to sandbox containment (Broadcom Advisory, Security Affairs).

The root cause is a heap overflow (CWE-787) in the PVSCSI controller emulation code within the VMX process, which handles paravirtualized SCSI I/O operations for guest virtual machines. An attacker operating from within a guest VM with local administrative privileges can craft malicious SCSI commands or control structures that trigger the heap overflow, resulting in an out-of-bounds write in the host's VMX process memory. On ESXi, exploitation is further constrained by the VMX sandbox and is only possible with unsupported configurations, while on Workstation and Fusion the VMX process runs with fewer restrictions, enabling direct code execution on the host. The vulnerability was demonstrated at Pwn2Own Berlin 2025, where researchers earned $340,000 for exploits targeting VMware products (Broadcom Advisory, BleepingComputer, Security Week).

Successful exploitation allows an attacker with guest VM administrative access to execute arbitrary code as the VMX process on the hypervisor host, effectively achieving a virtual machine escape. On Workstation and Fusion, this results in full code execution on the underlying host machine, threatening confidentiality, integrity, and availability of all data and workloads on that host. On ESXi, the impact is partially mitigated by the VMX sandbox, but exploitation under unsupported configurations could still compromise host-level processes. The scope change (S:C) in the CVSS score reflects the ability to affect resources beyond the guest VM boundary, enabling potential lateral movement to other VMs or host infrastructure (Broadcom Advisory).

CVE-2025-41238 was exploited at Pwn2Own Berlin 2025 by researchers from Synacktiv, making it a demonstrated, real-world exploit in a controlled competition setting. The Zero Day Initiative published an advisory (ZDI-26-190) on March 16, 2026, and Security Affairs reported on the Pwn2Own exploitation context. No public proof-of-concept exploit code is currently available for general use, and there is no evidence of in-the-wild exploitation outside the competition. The EPSS score is approximately 0.017% (very low), and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (ZDI Advisory, Security Affairs, Security Week).

1. Gain guest VM administrative access: Obtain local administrative (root/Administrator) privileges within a target virtual machine running on a vulnerable VMware ESXi, Workstation, or Fusion host.
2. Identify PVSCSI controller: Confirm the VM is configured with a PVSCSI (Paravirtualized SCSI) controller, which is the vulnerable component. This is a common storage adapter type in VMware environments.
3. Craft malicious SCSI commands: Develop or use a crafted sequence of SCSI I/O requests or control structures targeting the PVSCSI controller emulation layer that triggers a heap overflow in the host's VMX process.
4. Trigger out-of-bounds write: Submit the malicious SCSI commands from within the guest VM, causing the VMX process on the host to write beyond the bounds of an allocated heap buffer, corrupting adjacent memory.
5. Achieve code execution: Leverage the heap corruption to redirect execution flow within the VMX process, executing attacker-controlled code on the host (or within the VMX sandbox on ESXi). On Workstation/Fusion, this yields full host-level code execution (Broadcom Advisory, ZDI Advisory).

• Process: Unexpected child processes spawned by the VMX process (e.g., shells, network utilities) on the ESXi host or Workstation/Fusion host machine.
• Logs: VMX process crash logs or core dumps in the VMware log directory (e.g., /var/log/vmware/ on ESXi, or the VM's working directory); unusual SCSI error messages or PVSCSI-related exceptions in vmware.log within the VM's directory.
• File System: Unexpected files written to the host filesystem by the VMX process; new or modified files in VMware installation directories not associated with legitimate updates.
• Network: Unexpected outbound network connections originating from the VMX process PID on the host, particularly to external IPs.
• System: Abnormal CPU or memory usage by the VMX process; VMX process restarts or crashes coinciding with unusual guest VM SCSI activity (Broadcom Advisory).

Broadcom has released patches addressing CVE-2025-41238 as part of VMSA-2025-0013. Apply the following fixed versions: ESXi 8.0 → ESXi80U3f-24784735 or ESXi80U2e-24789317; ESXi 7.0 → ESXi70U3w-24784741; VMware Workstation 17.x → 17.6.4; VMware Fusion 13.x → 13.6.4; VMware Cloud Foundation 5.x/4.5.x → async patch to the respective ESXi builds. No workarounds are available; patching is the only remediation. As interim risk reduction, restrict local administrative access within guest VMs to trusted users only and avoid unsupported PVSCSI configurations on ESXi (Broadcom Advisory).

The vulnerability received significant attention due to its Pwn2Own Berlin 2025 origin, where Synacktiv researchers Thomas Bouzerar and Etienne Helluy-Lafont demonstrated the exploit and collectively earned $340,000 across VMware-related findings. Security Week, BleepingComputer, and Security Affairs all covered the patch release, emphasizing the VM escape risk. The r/vmware and r/sysadmin Reddit communities discussed the advisory actively, with administrators noting urgency for patching Workstation and Fusion deployments. Multiple national CERTs (Canada, Singapore, Hong Kong, Belgium, EU) issued advisories urging prompt patching (Security Week, BleepingComputer, Security Affairs).