VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2025-03-04

[ Description ]Official description

VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. A malicious actor with administrative privileges to a virtual machine may be able to exploit this issue to leak memory from the vmx process.

CISA: VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. Successful exploitation allows an attacker with administrative privileges to a virtual machine to leak memory from the vmx process.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 25 Mar 2025): Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAd…Vendor Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource