CVE-2025-41239 HIGH

CVE-2025-41239: vSockets information-disclosure vulnerability

Vendor Vmware
Product ESXi
Weakness CWE-908
Published July 15, 2025
Last update July 15, 2025

CVSS base score

7.1/10
Attack vector Local
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

What the vulnerability does

01Description

VMware ESXi, Workstation, Fusion, and VMware Tools contains an information disclosure vulnerability due to the usage of an uninitialised memory in vSockets. A malicious actor with local administrative privileges on a virtual machine may be able to exploit this issue to leak memory from processes communicating with vSockets.

Key dates

02Disclosure timeline

July 15, 2025 CVE published
July 15, 2025 Record updated