CVE-2025-41227

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

VMware ESXi, Workstation, and Fusion contain a denial-of-service vulnerability due to certain guest options. A malicious actor with non-administrative privileges within a guest operating system may be able to exploit this issue by exhausting memory of the host process leading to a denial-of-service condition.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

VendorProductVersions
VMwareESXi>= 8.0, < ESXi80U3se-24659227; >= 7.0, < ESXi70U3sv-24723868
VMwareCloud Foundation5.x, 4.5.x
VMwareTelco Cloud Platform5.x, 4.x, 3.x, 2.x
VMwareTelco Cloud Infrastructure3.x, 2.x
VMwareWorkstation>= 17.x, < 17.6.3
VMwareFusion>= 13.x, < 13.6.3

References

Timeline

Published
May 20, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-412284.3VMware ESXi and vCenter Server contain a reflected cross-site scripting vulnerability due to improper input validation. A malicious actor wiCVE-2025-412298.2VMware Cloud Foundation contains a directory traversal vulnerability. A malicious actor with network access to port 443 on VMware Cloud FounCVE-2025-41236.1A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attaCVE-2025-412307.5VMware Cloud Foundation contains an information disclosure vulnerability. A malicious actor with network access to port 443 on VMware Cloud CVE-2025-412317.3VMware Cloud Foundation contains a missing authorisation vulnerability. A malicious actor with access to VMware Cloud Foundation appliance mCVE-2025-412329.1Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass. YoCVE-2025-412336.8Description: VMware AVI Load Balancer contains an authenticated blind SQL Injection vulnerability. VMware has evaluated the severity of theCVE-2025-412346.5Description In Spring Framework, versions 6.0.x as of 6.0.5, versions 6.1.x and 6.2.x, an application is vulnerable to a reflected file dowCVE-2025-412358.6Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies.CVE-2025-412369.3VMware ESXi, Workstation, and Fusion contain an integer-overflow vulnerability in the VMXNET3 virtual network adapter. A malicious actor witCVE-2025-412379.3VMware ESXi, Workstation, and Fusion contain an integer-underflow in VMCI (Virtual Machine Communication Interface) that leads to an out-of-CVE-2025-412389.3VMware ESXi, Workstation, and Fusion contain a heap-overflow vulnerability in the PVSCSI (Paravirtualized SCSI) controller that leads to an