VMware has released security updates addressing four critical vulnerabilities in its ESXi, Workstation, Fusion, and Tools products. These flaws were successfully exploited as zero-day attacks during the Pwn2Own Berlin 2025 hacking contest in May 2025.
## High-Severity Virtual Machine Escape Vulnerabilities
Three of the patched vulnerabilities carry a critical severity rating of 9.3, enabling attackers to break out of virtual machines and execute commands on the host system:
**CVE-2025-41236** affects the VMXNET3 virtual network adapter, containing an integer-overflow vulnerability. Security researcher Nguyen Hoang Thach of STARLabs SG demonstrated this exploit at Pwn2Own.
**CVE-2025-41237** involves an integer-underflow in the Virtual Machine Communication Interface (VMCI) that triggers an out-of-bounds write condition. Corentin BAYET of REverse Tactics exploited this flaw during the contest.
**CVE-2025-41238** contains a heap-overflow vulnerability in the Paravirtualized SCSI (PVSCSI) controller, leading to out-of-bounds write conditions. Attackers with local administrative privileges on a virtual machine can exploit this to execute code as the VMX process on the host. Thomas Bouzerar and Etienne Helluy-Lafont of Synacktiv demonstrated this vulnerability.
## Information Disclosure Vulnerability
The fourth vulnerability, **CVE-2025-41239**, received a 7.1 severity rating for information disclosure. Also discovered by Corentin BAYET of REverse Tactics, this flaw was chained with CVE-2025-41237 during the hacking competition.
## Patch Requirements
VMware has not provided workarounds for these vulnerabilities. Organizations must install the latest software versions to address these security flaws. CVE-2025-41239 specifically impacts VMware Tools for Windows, requiring a separate upgrade process.
## Pwn2Own Berlin 2025 Results
These vulnerabilities were among 29 zero-day exploits demonstrated at Pwn2Own Berlin 2025, where security researchers earned a total of $1,078,750 in prize money for their discoveries.
Organizations using affected VMware products should prioritize applying these security updates immediately to prevent potential virtual machine escape attacks.