CVE-2025-41238
VMware ESXi, Workstation, and Fusion contain a heap-overflow vulnerability in the PVSCSI (Paravirtualized SCSI) controller that leads to an out of-bounds write. A malicious actor with local adminis...
Affects 0 products across 4 vendors.
Software writes data past buffer boundaries, corrupting memory and potentially enabling code execution.
VMware ESXi, Workstation, and Fusion are affected by a heap-overflow vulnerability in the PVSCSI controller, which could allow a local attacker with administrative privileges to execute arbitrary code on the host. The impact is limited on ESXi due to the VMX sandbox, but Workstation and Fusion are more vulnerable. The CVSS score is 9.3, indicating a high severity level.
BSID: BS-2025-GLOBAL-259599-C • Model: Qwen/Qwen2.5-72B-Instruct-AWQ • Confidence: HIGH
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2025-41238?
What is the CVSS score for CVE-2025-41238?
Is CVE-2025-41238 actively exploited?
How do I remediate CVE-2025-41238?
What systems are affected by CVE-2025-41238?
What NERC-CIP standard applies to CVE-2025-41238?
What IEC 62443 requirement maps to CVE-2025-41238?
| CVE ID | CVE-2025-41238 |
|---|---|
| BSID | BS-2025-GLOBAL-259599-C BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| Published | 2025-07-15 |
| Last Modified | 2026-06-17 |
| ICS Relevance | 70% |
| Weakness (CWE) | |
| Verticals | |
| Domains | |
| Source | NVD |
VMware ESXi, Workstation, and Fusion contain a heap-overflow vulnerability in the PVSCSI (Paravirtualized SCSI) controller that leads to an out of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox and exploitable only with configurations that are unsupported. On Workstation and Fusion, this may lead to code execution on the machine where Workstation or Fusion is installed.
Source: NIST NVD / MITRE CVE Database
The vulnerability exists in the PVSCSI controller, which can be exploited by a local attacker with administrative privileges on a virtual machine. The attacker can trigger an out-of-bounds write, leading to code execution on the host system. On ESXi, the exploitation is contained within the VMX sandbox and requires unsupported configurations. On Workstation and Fusion, the vulnerability can lead to code execution on the host machine.
Exploitation Likelihood: MEDIUM
| Vendor | Product | Affected Versions |
|---|---|---|
| Fusion | — | — |
| Rockwell Automation | — | — |
| Sandbox | — | — |
| Vmware | — | — |
| CISA known-exploited | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
Implement strict access controls and monitor for unauthorized administrative activities on virtual machines. Ensure that only trusted users have administrative privileges.
No reliable network detection signature exists for this vulnerability class — apply the compensating controls above and the vendor patch. A network rule is only drafted when a concrete on-the-wire signature can be grounded in the advisory.
This CVE violates CIP-007-R2 because it allows unauthorized access to critical cyber assets, potentially leading to the execution of arbitrary code on the host system.
This CVE maps to SR 7.6 because it involves a vulnerability that can be exploited to gain control over the system, which is a critical security concern in ICS environments.
Drafted by AI and not validated for your network. Test in an isolated environment before any production deployment. Compensating control only - does not replace vendor patch.
AI Enrichment Record — provenance & audit hash
| Model | Qwen/Qwen2.5-72B-Instruct-AWQ |
|---|---|
| Confidence | HIGH |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | 5a7c9920cdb319aa8fb3bc74c03b24bef1a6e50382b556e6b53d963113f45bc795b64b1786f26e01371d394d380b129598cbef86a9784bef26f97a6f08a60ecb |
Critical Severity - Know Your Exposure
A CVSS 9.3 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.
Create a free account →