← Back

CVE-2025-41244

nvd nist
Published: Sep 29, 2025Modified: Jun 17, 2026CISA KEV

JSON object

Loading...
7.8
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 1.8 / Impact: 5.9
Source: security@vmware.com (Secondary)

Description

VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.

Affected (10)

Vmware
7 products
Aria Operations
Cloud Foundation
Cloud Foundation Operations
Open Vm Tools
Telco Cloud Infrastructure
Telco Cloud Platform
Tools
Debian
1 product
Debian Linux
Configuration A
7 vulnerable
Vulnerable SoftwareAffected Versions
Aria Operations
From 8.0 to 8.18.5
Cloud Foundation
From 4.0 to 5.2.2
Cloud Foundation Operations
Version 9.0
Vmware
Open Vm Tools
From 11.2.0 to 12.5.4
Open Vm Tools
Version 13.0.0
Telco Cloud Infrastructure
From 2.2 to 3.0
Telco Cloud Platform
From 4.0 to 5.0.1
Configuration B
1 vulnerable
Vulnerable SoftwareAffected Versions
Debian Linux
Version 11.0
Configuration C
2 vulnerable · 2 platform
Vulnerable SoftwareAffected Versions
Vmware
Tools
From 12.5.0 to 12.5.4
Tools
From 13.0.0.0 to 13.0.5.0
Running on/withPlatform Versions
Linux
Linux Kernel
All versions
Microsoft
Windows
All versions

Related CWEs

CWE-267
Privilege Defined With Unsafe Actions
A particular privilege, role, capability, or right can be used to perform unsafe actions that were not intended, even when it is assigned to the correct entity.

References (6)

Source: security@vmware.com
Permissions Required
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
ExploitThird Party Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Vendor Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
US Government Resource

Timeline

No history available yet.