This vulnerability (CVE-2025-62627) is an untrusted pointer dereference (CWE-822) in the ionic cloud driver component of VMware ESXi 8.x and 9.x hosts using AMD-Pensando DPU products. It allows a low-privileged attacker operating within an unprivileged VM to read sensitive kernel memory or memory belonging to other co-located guest VMs. The CVSS 4.0 base score is 7.2, reflecting local attack vector, high attack complexity, no user interaction, and significant impact on confidentiality and availability. The vendor (AMD) has published the vulnerability but has not provided a patch or remediation level at this time. This is not a cloud service vulnerability, and no known exploits are reported in the wild.

Successful exploitation could result in unauthorized disclosure of sensitive kernel or guest VM memory contents, potentially compromising confidentiality. There is also a risk of impacting system availability. The attacker requires local access with an unprivileged VM and must overcome high attack complexity. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to ESXi hosts using AMD-Pensando DPU products to trusted users only. Monitor vendor channels for updates and apply patches promptly once released.