This vulnerability (CVE-2025-41237) involves an integer underflow in the Virtual Machine Communication Interface (VMCI) of VMware ESXi, Workstation, and Fusion. The flaw results in an out-of-bounds write, which can be exploited by a local attacker with administrative privileges inside a virtual machine to execute arbitrary code with the privileges of the VMX process on the host. The impact differs by product: on ESXi, the attack is contained within the VMX sandbox, whereas on Workstation and Fusion, it may lead to full code execution on the host system. The vulnerability affects several versions of VMware Cloud Foundation products. The CVSS v3.1 base score is 9.3, reflecting high impact on confidentiality, integrity, and availability. No known exploits in the wild or patches have been reported at this time.

Successful exploitation allows local attackers with administrative privileges inside a virtual machine to execute code on the host system with VMX process privileges. This can lead to full compromise of the host on Workstation and Fusion, or sandboxed code execution on ESXi. The vulnerability affects confidentiality, integrity, and availability of the host environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict local administrative access within virtual machines to trusted users only. Monitor VMware's security advisories for updates and apply patches promptly once available.