Memory leak in VMware ESXi - CVE-2025-41239

Vulnerability identifier: #VU113009

CSH Severity: Medium

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N]

CVE-ID: CVE-2025-41239

CWE-ID: CWE-401

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows an attacker to gain access to sensitive information.

The vulnerability exists due memory leak in vSockets. A malicious guest with local administrative privileges on a virtual machine can leak memory from processes communicating with vSockets.

VMware ESXi
IBM Cloud Pak System
VMware Tools
VMware Fusion
VMware Workstation
Cloud Foundation

Install updates from vendor's website.

VMware ESXi - addressed in versions ESXi80U2e-24789317, ESXi70U3w-24784741, ESXi80U3f-24784735
IBM Cloud Pak System - update to 2.3.6.1
VMware Tools - addressed in versions 12.5.3, 13.0.1.0
VMware Fusion - update to 13.6.4
VMware Workstation - update to 17.6.4
Cloud Foundation - addressed in versions ESXi70U3w-24784741, ESXi80U3f-24784735

• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/35877

• Multiple vulnerabilities in VMware ESXi
• Multiple vulnerabilities in VMware Workstation
• Multiple vulnerabilities in VMware Fusion
• Memory leak in VMware Tools for Windows
• Multiple vulnerabilities in VMware Cloud Foundation
• Multiple vulnerabilities in IBM Cloud Pak System