CVE-2025-41239
High
Description
VMware ESXi, Workstation, Fusion, and VMware Tools contains an information disclosure vulnerability due to the usage of an uninitialised memory in vSockets. A malicious actor with local administrative privileges on a virtual machine may be able to exploit this issue to leak memory from processes communicating with vSockets.
SeverityHigh
CVSS7.1
Exploit probability—
Product
ESXi
PublishedJul 15, 2025
First seenJul 15, 2025
Weakness typeCWE-908CWE-908
How to fix
Update
- VMware ESXiESXi80U3f-24784735, ESXi80U2e-24789317, ESXi70U3w-24784741 or later
- VMware Workstation17.6.4 or later
- VMware Fusion13.6.4 or later
- VMware Tools13.0.1.0, 12.5.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| VMware ESXi | 8.0 ≤ v < ESXi80U3f-24784735, 8.0 ≤ v < ESXi80U2e-24789317, 7.0 ≤ v < ESXi70U3w-24784741 | ESXi80U3f-24784735, ESXi80U2e-24789317, ESXi70U3w-24784741 |
| VMware Cloud Foundation | 5.x, 4.5.x | — |
| VMware Workstation | 17.x ≤ v < 17.6.4 | 17.6.4 |
| VMware Fusion | 13.x ≤ v < 13.6.4 | 13.6.4 |
| VMware Telco Cloud Platform | 5.x, 4.x, 3.x, 2.x | — |
| VMware Telco Cloud Infrastructure | 3.x, 2.x | — |
| VMware Tools | 13.x.x ≤ v < 13.0.1.0, 12.x.x, 11.x.x, ≤ v < 12.5.3 | 13.0.1.0, 12.5.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.