CVE-2025-41227

VMware ESXi, Workstation, and Fusion contain a denial-of-service vulnerability due to certain guest options. A malicious actor with non-administrative privileges within a guest operating system may be able to exploit this issue by exhausting memory of the host process leading to a denial-of-service condition.

Score

CVSS 3.1 5.5 Medium

Status

Deferred - security@vmware.com

Published

2025-05-20

Last modified

2025-06-24

Weaknesses

CWE-400

Affected products

• Cloud Foundation (Vmware)
• Esxi (Vmware)
• Fusion (Vmware)
• Telco Cloud Infrastructure (Vmware)
• Telco Cloud Platform (Vmware)
• Workstation (Vmware)

References

• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25717