{"id":"CVE-2025-41239","aliases":["EUVD-2025-21539","GHSA-8p72-rxh7-qv97"],"status":"published","title":"vSockets information-disclosure vulnerability","description":"VMware ESXi, Workstation, Fusion, and VMware Tools contains an information disclosure vulnerability due to the usage of an uninitialised memory in vSockets. A malicious actor with local administrative privileges on a virtual machine may be able to exploit this issue to leak memory from processes communicating with vSockets.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.03159,"percentile":0.88142,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-908"],"published":"2025-07-15T18:35:03Z","modified":"2026-06-17T09:22:39Z","products":[{"vendor":"vmware","product":"cloud foundation"},{"vendor":"vmware","product":"esxi"},{"vendor":"vmware","product":"fusion"},{"vendor":"vmware","product":"telco cloud infrastructure"},{"vendor":"vmware","product":"telco cloud platform"},{"vendor":"vmware","product":"tools"},{"vendor":"vmware","product":"workstation"}],"references":[{"url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/35877"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-41239"},{"url":"https://github.com/advisories/GHSA-8p72-rxh7-qv97"}],"sources":{"cve":[{"id":"CVE-2025-41239","title":"vSockets information-disclosure vulnerability","description":"VMware ESXi, Workstation, Fusion, and VMware Tools contains an information disclosure vulnerability due to the usage of an uninitialised memory in vSockets. A malicious actor with local administrative privileges on a virtual machine may be able to exploit this issue to leak memory from processes communicating with vSockets.","status":"published","published":"2025-07-15T18:35:03.747Z","modified":"2025-07-15T18:51:58.342Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-908"],"updated_at":"2026-11-02T14:32:31.631102Z"}],"euvd":[{"id":"EUVD-2025-21539","description":"VMware ESXi, Workstation, Fusion, and VMware Tools contains an information disclosure vulnerability due to the usage of an uninitialised memory in vSockets. A malicious actor with local administrative privileges on a virtual machine may be able to exploit this issue to leak memory from processes communicating with vSockets.","status":"published","published":"2025-07-15T18:35:03Z","modified":"2025-07-15T18:51:58Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T20:32:07.830372Z"}],"ghsa":[{"id":"GHSA-8p72-rxh7-qv97","title":"VMware ESXi, Workstation, Fusion, and VMware Tools contains an information disclosure...","description":"VMware ESXi, Workstation, Fusion, and VMware Tools contains an information disclosure vulnerability due to the usage of an uninitialised memory in vSockets. A malicious actor with local administrative privileges on a virtual machine may be able to exploit this issue to leak memory from processes communicating with vSockets.","status":"published","published":"2025-07-15T21:31:39Z","modified":"2025-07-15T21:31:43Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-908"],"updated_at":"2026-11-02T15:03:01.660442Z"}],"nvd":[{"id":"CVE-2025-41239","description":"VMware ESXi, Workstation, Fusion, and VMware Tools contains an information disclosure vulnerability due to the usage of an uninitialised memory in vSockets. A malicious actor with local administrative privileges on a virtual machine may be able to exploit this issue to leak memory from processes communicating with vSockets.","status":"published","published":"2025-07-15T19:15:22.557Z","modified":"2026-06-17T09:22:39.373Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-908"],"updated_at":"2026-11-02T14:11:18.285862Z"}]}}