This vulnerability (CWE-125) involves an out-of-bounds read in VMware ESX, Workstation, and Fusion. An attacker with VM deployment privileges can trigger this vulnerability, potentially causing information disclosure or a denial-of-service condition on the host process. The vulnerability affects VMware Cloud Foundation versions 9.0.x.x, 9.1.x.x, and versions from 5.0.0 up to but not including 6.0.0. The CVSS v3.1 base score is 7.6 (high severity), with network attack vector, low attack complexity, high privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact. No official patch or remediation level is currently provided by the vendor, and no known exploits are reported in the wild.

Successful exploitation can lead to information disclosure on VMware Workstation and Fusion, and potentially denial-of-service conditions on VMware ESX host processes. The confidentiality impact is high, while integrity is not affected and availability impact is low. The attacker must have VM deployment privileges, limiting the attack surface to authorized users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, monitor VMware advisories for updates. Limit VM deployment privileges to trusted users to reduce risk until a fix is available.