VulnSocial

CVE-2025-41236Disclosure

LOWCVSS 9.3 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

VMware ESXi, Workstation, and Fusion contain an integer-overflow vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Non VMXNET3 virtual adapters are not affected by this issue.

Back to dashboard
1.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-787

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Threat summary

  • Public PoC is present in monitored signal
  • 1 mentions across 1 observed day

What's happening

  • PoC mentioned or linked in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-03-16: 1PoC Mentioned / Linked · 2026-03-16: 1Technical Details · 2026-03-16: 103-16
Signal classification1 categories
Disclosure
1100.0%
Referenced assets1 URL
By indicator
Full discourse1 post
  • TheZDIBugs@TheZDIBugs
    Disclosure

    [ZDI-26-189|CVE-2025-41236] (Pwn2Own) VMware ESXi VMXNET3 Integer Overflow Local Privilege Escalation Vulnerability (CVSS 8.2; Credit: Nguyen Hoang Thach of STAR Labs SG Pte. Ltd.) https://www.zerodayinitiative.com/advisories/ZDI-26-189/

    Post summary

    The advisory announces a new integer‑overflow local privilege escalation flaw in VMware ESXi VMXNET3, cites a CVSS score of 8.2, and provides a link for further details.

    010741.1K
    5.4K followersView on X

Explore more

Back to dashboard