This vulnerability (CVE-2025-62627) is classified as CWE-822 (Untrusted Pointer Dereference) and affects the ionic cloud driver in VMware ESXi 8.x and 9.x hosts using AMD-Pensando DPU products. An attacker operating from an unprivileged VM could exploit this flaw to read sensitive kernel memory or memory belonging to other guest VMs on the same host. The CVSS 4.0 base score is 7.2, indicating high severity, with attack vector local, high attack complexity, and partial impact on confidentiality, integrity, and availability. The vulnerability was published on May 13, 2026, but no patch or official remediation level has been disclosed by AMD.

Successful exploitation could allow an attacker with access to an unprivileged VM to read sensitive kernel memory or memory from other guest VMs on the same host, potentially compromising confidentiality and availability. This could lead to unauthorized data disclosure or disruption of services running on the affected ESXi hosts. There is no evidence of known exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to unprivileged VMs and monitoring for unusual activity related to the ionic cloud driver. Do not assume the vulnerability is mitigated without vendor confirmation.