EUVD-2025-209813
GHSA-4r9g-wxw4-52qv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local low-privileged access to ESXi host
-
DeliverySend crafted input to ionic DPU driver
-
ExploitOverflow heap buffer in driver
-
ExecutionGroom heap to control execution
-
ImpactEscalate to arbitrary code execution on host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the ESXi host to be running AMD-Pensando DPU products with the ionic cloud driver in use - hosts without this hardware/driver are not exploitable. The attacker must already have local, low-privileged access to the host (CVSS AV:L, PR:L); this is not remotely reachable and not unauthenticated. High attack complexity (AC:H) further limits exploitation, implying heap-grooming or race/timing conditions must be met for reliable memory corruption. No user interaction is required (UI:N). Limiting factors: local access precondition, pre-existing privileges, the niche DPU hardware requirement, and non-trivial exploit reliability. |
| Impact | Signals are internally consistent and point to a serious-but-not-urgent issue. The CVSS 4.0 vector (AV:L/AC:H/AT:N/PR:L/UI:N) shows a local attack vector requiring existing low-level privileges and high attack complexity, but with total impact (VC:H/VI:H/VA:H plus subsequent-system SC:H/SI:H/SA:H reflecting escalation beyond the initial context). SSVC reinforces this: Exploitation 'none', Automatable 'no', but Technical Impact 'total'. EPSS is very low (0.01%, 3rd percentile), and there is no CISA KEV listing and no POC identified - so despite the high 8.8 score, real-world exploitation pressure today is low. The gating factors (local access, pre-existing privileges, high complexity, and the hard requirement that the host actually run AMD-Pensando DPU hardware) sharply narrow the exploitable population. This is a high-severity flaw worth patching on affected DPU-equipped hosts, but not a mass-exploitation or internet-facing emergency. No conflicting signals were observed; the only meaningful limiter not captured by CVSS alone is the niche hardware prerequisite. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged local foothold on a DPU-equipped ESXi host (for example a constrained management account or a compromised low-privilege process) sends crafted input through the ionic driver interface to overflow a heap buffer, corrupting adjacent memory. By grooming the heap they steer the corruption toward controlling execution in the privileged driver context, escalating to arbitrary code execution at host level. No public POC is currently identified, and the high attack complexity means reliable exploitation requires precise control of the driver's heap state. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Local privilege escalation in the ionic cloud driver used by VMware ESXi 8.x and 9.x hosts running AMD-Pensando DPU products allows a low-privileged local attacker to corrupt heap memory and potentially execute arbitrary code with elevated (host-level) privileges. The flaw was reported by AMD (AMD-SB-2001) and carries a CVSS 4.0 base score of 8.8 with a 'total' technical impact under SSVC. There is no public exploit identified at time of analysis and EPSS is negligible (0.01%, 3rd percentile), consistent with SSVC exploitation status of 'none'.
RemediationAI
Vendor-released patch: apply ESXi 8.0U3i, or move to a build that includes the fix - VCF 5.2.3.0 or 9.0.2 - on any ESXi 8.x/9.x host equipped with AMD-Pensando DPU products, per AMD bulletin AMD-SB-2001 (https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-2001.html). Because exploitation requires local, already-privileged access to the host, the strongest compensating control until patching is tightening who can obtain that foothold: restrict ESXi shell/SSH and administrative access to trusted operators only, keep lockdown mode enabled, and enforce least privilege for host-management accounts (trade-off: reduced operational convenience for administrators). Where a maintenance window is not immediately possible, prioritize DPU-equipped hosts over the general fleet, since only hosts using the AMD-Pensando DPU and ionic driver are exposed. No feature-level disable is documented for the ionic driver itself, so patching remains the definitive remediation.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the 'ionic' cloud driver, the ESXi kernel driver that services AMD-Pensando Distributed Processing Unit (DPU) SmartNIC devices. AMD-Pensando DPUs offload networking, storage, and security functions from the host, and the ionic driver bridges these hardware functions into the ESXi hypervisor. CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), realized here as a heap-based buffer overflow, indicates the driver writes past an allocated heap buffer - typically the result of missing or incorrect length validation on data crossing the driver/device boundary. Because the driver runs in a privileged hypervisor context, memory corruption there can translate directly into control over host-level execution. Affected products per CPE are limited to 'amd:esxi_8.x_and_esxi_9.x_hosts_using_amd-pensando_dpu_products', i.e. only ESXi deployments that actually have AMD-Pensando DPU hardware and the ionic driver in use.
Know when Esxi 8 X And Esxi 9 X Hosts Using Amd Pensando Dpu Products gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Local access with existing low privileges (AV:L/PR:L), heap-grooming makes it AC:H, and driver-to-host escalation with total compromise justifies S:C and C/I/A:H.
Primary rating from Vendor (AMD).
CVSS VectorVendor: AMD
Lifecycle Timeline
2DescriptionCVE.org
A heap-based buffer overflow in the ionic cloud driver for VMware ESXi could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution.
Executive ViewAI
ESXi hypervisors with AMD-Pensando DPU drivers in your environment have an exploitable local privilege-escalation path that allows any local user to assume hypervisor control and access all hosted virtual machines. No vendor patch currently exists, and while no active exploitation has been observed, the unavailability of a fix requires immediate interim containment strategies. This exposure applies to all ESXi 8.x and 9.x deployments using AMD-Pensando DPU hardware.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict local user shell access on affected ESXi hosts to trusted administrators only; disable unnecessary services on the ionic cloud driver where supported; implement enhanced privilege-escalation detection in hypervisor monitoring tools; apply network segmentation to isolate affected ESXi clusters from untrusted network segments; and establish detective controls for suspicious memory corruption patterns or local exploitation attempts on affected systems.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB