CVE-2025-41227

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-41227", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "state": "PUBLISHED", "assignerShortName": "vmware", "dateReserved": "2025-04-16T09:29:46.972Z", "datePublished": "2025-05-20T14:24:29.316Z", "dateUpdated": "2025-06-24T07:13:30.222Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "ESXi", "vendor": "VMware", "versions": [{"lessThan": "ESXi80U3se-24659227", "status": "affected", "version": "8.0", "versionType": "custom"}, {"lessThan": "ESXi70U3sv-24723868", "status": "affected", "version": "7.0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Cloud Foundation", "vendor": "VMware", "versions": [{"status": "affected", "version": "5.x, 4.5.x"}]}, {"defaultStatus": "unaffected", "product": "Telco Cloud Platform", "vendor": "VMware", "versions": [{"status": "affected", "version": "5.x, 4.x, 3.x, 2.x"}]}, {"defaultStatus": "unaffected", "product": "Telco Cloud Infrastructure", "vendor": "VMware", "versions": [{"status": "affected", "version": "3.x, 2.x"}]}, {"defaultStatus": "unaffected", "product": "Workstation", "vendor": "VMware", "versions": [{"lessThan": "17.6.3", "status": "affected", "version": "17.x", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Fusion", "vendor": "VMware", "versions": [{"lessThan": "13.6.3", "status": "affected", "version": "13.x", "versionType": "custom"}]}], "datePublic": "2025-05-20T11:30:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "VMware ESXi,&nbsp;<span style=\"background-color: rgb(255, 255, 255);\">Workstation, and Fusion contain a denial-of-service vulnerability due to certain guest options.&nbsp;<span style=\"background-color: rgb(255, 255, 255);\">A malicious actor with non-administrative privileges within a guest operating system may be able to exploit this issue by exhausting memory of the host process leading to a denial-of-service condition.</span><br></span><br>"}], "value": "VMware ESXi,\u00a0Workstation, and Fusion contain a denial-of-service vulnerability due to certain guest options.\u00a0A malicious actor with non-administrative privileges within a guest operating system may be able to exploit this issue by exhausting memory of the host process leading to a denial-of-service condition."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2025-06-24T07:13:30.222Z"}, "references": [{"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25717"}], "source": {"discovery": "UNKNOWN"}, "title": "Denial-of-Service Vulnerability", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-05-20T15:59:41.340433Z", "id": "CVE-2025-41227", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-20T16:00:12.860Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-41227", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-20T15:59:41.340433Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-20T15:59:59.651Z"}}], "cna": {"title": "Denial-of-Service Vulnerability", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "VMware", "product": "ESXi", "versions": [{"status": "affected", "version": "8.0", "lessThan": "ESXi80U3se-24659227", "versionType": "custom"}, {"status": "affected", "version": "7.0", "lessThan": "ESXi70U3sv-24723868", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "VMware", "product": "Cloud Foundation", "versions": [{"status": "affected", "version": "5.x, 4.5.x"}], "defaultStatus": "unaffected"}, {"vendor": "VMware", "product": "Telco Cloud Platform", "versions": [{"status": "affected", "version": "5.x, 4.x, 3.x, 2.x"}], "defaultStatus": "unaffected"}, {"vendor": "VMware", "product": "Telco Cloud Infrastructure", "versions": [{"status": "affected", "version": "3.x, 2.x"}], "defaultStatus": "unaffected"}, {"vendor": "VMware", "product": "Workstation", "versions": [{"status": "affected", "version": "17.x", "lessThan": "17.6.3", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "VMware", "product": "Fusion", "versions": [{"status": "affected", "version": "13.x", "lessThan": "13.6.3", "versionType": "custom"}], "defaultStatus": "unaffected"}], "datePublic": "2025-05-20T11:30:00.000Z", "references": [{"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25717"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "VMware ESXi,\u00a0Workstation, and Fusion contain a denial-of-service vulnerability due to certain guest options.\u00a0A malicious actor with non-administrative privileges within a guest operating system may be able to exploit this issue by exhausting memory of the host process leading to a denial-of-service condition.", "supportingMedia": [{"type": "text/html", "value": "VMware ESXi,&nbsp;<span style=\"background-color: rgb(255, 255, 255);\">Workstation, and Fusion contain a denial-of-service vulnerability due to certain guest options.&nbsp;<span style=\"background-color: rgb(255, 255, 255);\">A malicious actor with non-administrative privileges within a guest operating system may be able to exploit this issue by exhausting memory of the host process leading to a denial-of-service condition.</span><br></span><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2025-06-24T07:13:30.222Z"}}}, "cveMetadata": {"cveId": "CVE-2025-41227", "state": "PUBLISHED", "dateUpdated": "2025-06-24T07:13:30.222Z", "dateReserved": "2025-04-16T09:29:46.972Z", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "datePublished": "2025-05-20T14:24:29.316Z", "assignerShortName": "vmware"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "ESXi", "vendor": "VMware", "versions": [{"lessThan": "ESXi80U3se-24659227", "status": "affected", "version": "8.0", "versionType": "custom"}, {"lessThan": "ESXi70U3sv-24723868", "status": "affected", "version": "7.0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Cloud Foundation", "vendor": "VMware", "versions": [{"status": "affected", "version": "5.x, 4.5.x"}]}, {"defaultStatus": "unaffected", "product": "Telco Cloud Platform", "vendor": "VMware", "versions": [{"status": "affected", "version": "5.x, 4.x, 3.x, 2.x"}]}, {"defaultStatus": "unaffected", "product": "Telco Cloud Infrastructure", "vendor": "VMware", "versions": [{"status": "affected", "version": "3.x, 2.x"}]}, {"defaultStatus": "unaffected", "product": "Workstation", "vendor": "VMware", "versions": [{"lessThan": "17.6.3", "status": "affected", "version": "17.x", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Fusion", "vendor": "VMware", "versions": [{"lessThan": "13.6.3", "status": "affected", "version": "13.x", "versionType": "custom"}]}], "source": "security@vmware.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "VMware ESXi,\u00a0Workstation, and Fusion contain a denial-of-service vulnerability due to certain guest options.\u00a0A malicious actor with non-administrative privileges within a guest operating system may be able to exploit this issue by exhausting memory of the host process leading to a denial-of-service condition."}, {"lang": "es", "value": "VMware ESXi, Workstation y Fusion presentan una vulnerabilidad de denegaci\u00f3n de servicio debido a ciertas opciones de invitado. Un agente malicioso con privilegios no administrativos dentro de un sistema operativo invitado podr\u00eda explotar este problema agotando la memoria del proceso del host, lo que provoca una condici\u00f3n de denegaci\u00f3n de servicio."}], "id": "CVE-2025-41227", "lastModified": "2026-06-17T09:22:38.070", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "security@vmware.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-41227", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-05-20T15:59:41.340433Z", "version": "2.0.3"}}]}, "published": "2025-05-20T15:16:07.827", "references": [{"source": "security@vmware.com", "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25717"}], "sourceIdentifier": "security@vmware.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "security@vmware.com", "type": "Secondary"}]}

{}

{"created": "2025-06-23T19:31:59.577846+00:00", "updated": "2025-06-23T19:31:59.577926+00:00", "vendors": ["vmware", "vmware$PRODUCT$esxi", "vmware$PRODUCT$fusion", "vmware$PRODUCT$workstation"]}