← Back

CVE-2025-41244

nvd nist
Published: Sep 29, 2025Modified: Oct 18, 2026CISA KEV

JSON object

Loading...
7.8
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 1.8 / Impact: 5.9
Source: security@vmware.com (Secondary)

Description

VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.

Affected (10)

Vmware
7 products
Aria Operations
Cloud Foundation
Cloud Foundation Operations
Open Vm Tools
Telco Cloud Infrastructure
Telco Cloud Platform
Tools
Debian
1 product
Debian Linux
Configuration A
7 vulnerable
Vulnerable SoftwareAffected Versions
Aria Operations
8.0 ≤ version < 8.18.5
Cloud Foundation
4.0 ≤ version ≤ 5.2.2
Cloud Foundation Operations
Version 9.0
Vmware
Open Vm Tools
11.2.0 ≤ version < 12.5.4
Open Vm Tools
Version 13.0.0
Telco Cloud Infrastructure
2.2 ≤ version ≤ 3.0
Telco Cloud Platform
4.0 ≤ version < 5.0.1
Configuration B
1 vulnerable
Vulnerable SoftwareAffected Versions
Debian Linux
Version 11.0
Configuration C
2 vulnerable · 2 platform
Vulnerable SoftwareAffected Versions
Vmware
Tools
12.5.0 ≤ version < 12.5.4
Tools
13.0.0.0 ≤ version < 13.0.5.0
Running on/withPlatform Versions
Linux
Linux Kernel
All versions
Microsoft
Windows
All versions

Related CWEs

CWE-267
Privilege Defined With Unsafe Actions
A particular privilege, role, capability, or right can be used to perform unsafe actions that were not intended, even when it is assigned to the correct entity.

References (6)

Source: security@vmware.com
Permissions Required
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
ExploitThird Party Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Vendor Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
US Government Resource

Timeline

No history available yet.