CVE-2025-41238: 
VMware Workstation vulnerability analysis and mitigation

VMware ESXi, Workstation, and Fusion contain a heap-overflow vulnerability in the PVSCSI (Paravirtualized SCSI) controller that leads to an out-of-bounds write, identified as CVE-2025-41238. The vulnerability was discovered during the Pwn2Own Berlin 2025 hacking contest in May 2025 and was publicly disclosed on July 15, 2025. This critical vulnerability affects VMware ESXi versions 7.0 and 8.0, Workstation Pro 17.x, and Fusion 13.x, receiving a CVSS v3.1 base score of 9.3 (VMware Advisory, BleepingComputer).

The vulnerability exists in the PVSCSI (Paravirtualized SCSI) controller component and manifests as a heap-overflow condition leading to out-of-bounds write operations. The flaw was demonstrated by Thomas Bouzerar and Etienne Helluy-Lafont of Synacktiv during the Pwn2Own competition. When successfully exploited, it allows code execution within the virtual machine's VMX process context. The severity varies by deployment environment, with ESXi implementations only being vulnerable in unsupported configurations, while Workstation and Fusion installations face full exposure (Cybersecurity News, VMware Advisory).

The vulnerability enables a malicious actor with local administrative privileges on a virtual machine to execute code as the virtual machine's VMX process running on the host. On ESXi systems, the exploitation is contained within the VMX sandbox and is only exploitable with unsupported configurations. However, on Workstation and Fusion systems, successful exploitation can lead to code execution on the host machine where the virtualization software is installed, potentially resulting in complete system compromise (VMware Advisory, GBHackers).

Broadcom has released patches to address this vulnerability across all affected products. Users should update to ESXi80U3f-24784735 for ESXi 8.0, ESXi70U3w-24784741 for ESXi 7.0, Workstation Pro 17.6.4, and Fusion 13.6.4. No workarounds are available, making patch installation the only effective mitigation strategy (VMware Advisory).