CVE-2025-41244
Reported by vmware · Published September 29, 2025
VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| open-vm-tools-salt-minion | Amazon Linux | 12.3.0-1.amzn2023.0.5, 12.3.0-1.amzn2.0.4 |
| open-vm-tools-devel | Amazon Linux | 12.3.0-1.amzn2023.0.5, 12.3.0-1.amzn2.0.4 |
| open-vm-tools | Amazon Linux | 12.3.0-1.amzn2023.0.5, 12.3.0-1.amzn2.0.4 |
| open-vm-tools-test | Amazon Linux | 12.3.0-1.amzn2023.0.5, 12.3.0-1.amzn2.0.4 |
| open-vm-tools-desktop | Amazon Linux | 12.3.0-1.amzn2023.0.5, 12.3.0-1.amzn2.0.4 |
| open-vm-tools-sdmp | Amazon Linux | 12.3.0-1.amzn2023.0.5, 12.3.0-1.amzn2.0.4 |
| tools | vmware | 13.0.5.0, 12.5.4 |
| telco_cloud_infrastructure | vmware | 3.0 |
| VMware tools | VMware | 13.0.5.0, 12.5.4 |
| VMware Cloud Foundation | VMware | 8.18.5 |
| aria_operations | vmware | 8.18.5 |
| telco_cloud_platform | vmware | 5.0.1 |
6 more packages have a fixed version. See every fix in Lookup.
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| VMware | VCF operations | 9.0.x |
| VMware | VMware tools | 13.x.x.x, 12.5.x |
| VMware | VMware Aria Operations | 8.18.x |
| VMware | VMware Cloud Foundation | 5.x, 4.x |
| VMware | VMware Telco Cloud Platform | 5.x, 4.x |
| VMware | VMware Telco Cloud Infrastructure | 3.x, 2.x |
| amazon:2 | open-vm-tools-salt-minion | 0 |
| amazon:2023 | open-vm-tools-devel | 0 |
| VMware | VMware tools | 12.5.x, 13.x.x.x |
| VMware | VMware Cloud Foundation | 4.x, 5.x |
| amazon:2 | open-vm-tools | 0 |
| amazon:2 | open-vm-tools-test | 0 |
| VMware | VMware Telco Cloud Infrastructure | 3.x, 2.x |
| amazon:2023 | open-vm-tools-salt-minion | 0 |
| amazon:2 | open-vm-tools-devel | 0 |
| amazon:2023 | open-vm-tools-desktop | 0 |
| amazon:2 | open-vm-tools-sdmp | 0 |
| amazon:2023 | open-vm-tools-sdmp | 0 |
| amazon:2023 | open-vm-tools | 0 |
| VMware | VMware Aria Operations | 8.18.x |
…and 4 more
Timeline
- Sep 29, 2025 VulnCheck KEV Exploitation (5 in total, the first dated here)
- Sep 29, 2025 CVE Published
- Sep 30, 2025 EPSS Score (30 in total, the first dated here)
- Oct 6, 2025 VulnCheck XDB Entry
- Oct 30, 2025 CISA KEV Added
- Feb 26, 2026 CVE Updated
- Jun 2, 2026 Security Advisory (15 in total, the first dated here)
- Jun 8, 2026 Coalition ESS Score
- Oct 4, 2026 Distribution Patch (12 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2025-41244
vulnetix vdb fixes CVE-2025-41244Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2025-41244/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://blog.nviso.eu/2025/09/29/you-name-it-vmware-elevates-it-cve-2025-41244/ exploit
- https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36149 vendor-advisory
- http://www.openwall.com/lists/oss-security/2025/09/29/10 url
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-41244 advisory
- https://lists.debian.org/debian-lts-announce/2025/10/msg00000.html advisory