CVE-2025-62623 is a heap-based buffer overflow vulnerability in the ionic cloud driver component of VMware ESXi 8.x and 9.x hosts that utilize AMD-Pensando DPU products. This vulnerability arises from improper restriction of operations within the bounds of a memory buffer (CWE-119). Exploitation could allow an attacker with local, limited privileges to escalate their privileges and potentially execute arbitrary code on the affected host. The CVSS 4.0 base score is 8.8 (high), reflecting the complexity and impact factors including local attack vector, high attack complexity, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and no known exploits have been reported in the wild.

Successful exploitation of this vulnerability could lead to privilege escalation on affected VMware ESXi hosts using AMD-Pensando DPU products, potentially allowing arbitrary code execution. This could compromise the confidentiality, integrity, and availability of the host system. However, exploitation requires local access with limited privileges and has high attack complexity. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict local access to affected ESXi hosts and monitor for unusual activity related to the ionic cloud driver. Avoid deploying untrusted code or users with local access privileges on these systems. Follow vendor channels closely for updates and apply patches promptly once available.