EUVD-2026-51105
GHSA-8f48-75j5-mrf7
Severity by source
AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Description requires local administrative privileges inside the guest (PR:H) via a local vector (AV:L); the guest-to-host escape is a scope change (S:C) with full host C/I/A impact.
Primary rating from Vendor (vmware).
CVSS VectorVendor: vmware
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Non VMXNET3 virtual adapters are not affected by this issue.
Articles & Coverage 2
AnalysisAI
Guest-to-host escape in VMware ESX (and the ESX component of Cloud Foundation, vSphere Foundation, and Telco Cloud Platform) lets an attacker with administrative privileges inside a virtual machine execute code on the underlying hypervisor host via an out-of-bounds write in the VMXNET3 virtual network adapter. Only VMs configured with the VMXNET3 adapter are affected; other virtual NIC types are not. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) a virtual machine configured with the VMXNET3 virtual network adapter - VMs using any other virtual NIC are explicitly not affected - and (2) local administrative privileges inside that guest VM, per the vendor description. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score is 9.3 (Critical) with vector AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H: local attack vector, low complexity, no user interaction, and a scope change reflecting the guest-to-host escape with full confidentiality, integrity, and availability impact on the host. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has already gained administrative control of a guest VM (via prior compromise, a rogue tenant, or a malicious insider) loads a crafted VMXNET3 driver sequence or sends malformed device operations that trigger the out-of-bounds write in the host-side adapter emulation. By shaping the corruption, they achieve code execution in the hypervisor process, escaping the VM to control the ESX host and, by extension, other VMs on it. … |
| Remediation | Apply the fixed ESX build as directed by the Broadcom/VMware security advisory at https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017; an exact patched version was not present in the provided data, so treat patch status as 'patch available per vendor advisory' and confirm the precise build number and applicable updates for Cloud Foundation, vSphere Foundation, ESX, and Telco Cloud Platform directly from that advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Conduct an immediate asset inventory to identify all virtual machines configured with VMXNET3 adapters across your VMware estate, map which VMs operate with administrative privileges or host critical business functions, and implement network segmentation to restrict traffic from VMXNET3-equipped systems to management interfaces and sensitive infrastructure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Cloud Foundation
View allVMware ESXi and Workstation contain a TOCTOU race condition leading to out-of-bounds write, allowing local administrator
VMware ESXi contains an arbitrary write vulnerability that allows privileged VMX process users to trigger kernel writes,
VMware Aria Operations contains a command injection vulnerability (CVE-2026-22719, CVSS 8.1) that allows unauthenticated
VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability via HGFS out-of-bounds read, allowi
VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side templa
The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. Rated critical severity (CV
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. Rated critical sev
Remote code execution in VMware vCenter Server (and bundled distributions including Cloud Foundation, vSphere Foundation
The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo. Rated h
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due t
The vCenter Server contains multiple local privilege escalation vulnerabilities due to improper permissions of files and
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today