CVE-2025-41239CWE-908

vSockets information-disclosure vulnerability

High · published July 15, 2025

CVSS v3.1
7.1
EPSS
3%
Percentile
87.9
In the wild
Unconfirmed
What it is

VMware ESXi, Workstation, Fusion, and VMware Tools contains an information disclosure vulnerability due to the usage of an uninitialised memory in vSockets. A malicious actor with local administrative privileges on a virtual machine may be able to exploit this issue to leak memory from processes communicating with vSockets.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.03159 · 87.9th percentile
Weakness
CWE-908 · Use of Uninitialized Resource
Published
2025-07-15T18:35Z
EPSS history
Timeline
  • 15 JUL 18:35Z
    vSockets information-disclosure vulnerability
    cvelistv5