CVE-2025-41244

Published Sep 29, 2025

Last updated a month ago

VMware Tools

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-41244 is a local privilege escalation vulnerability affecting VMware Tools and VMware Aria Operations. It stems from overly broad regular expression patterns in the `get-versions.sh` component used by both VMware Tools and Aria Operations' Service Discovery Management Pack (SDMP). The `get_version()` function in this script scans for listening sockets and then executes matched binaries to retrieve version information. However, the use of the non-whitespace shorthand `\S` unintentionally includes user-writable directories such as `/tmp/httpd`. Attackers can exploit this by staging malicious binaries in these user-writable locations. The privileged VMware context then executes these binaries, leading to a local privilege escalation. By mimicking system binaries in writable paths, CVE-2025-41244 violates CWE-426: Untrusted Search Path, offering trivial local privilege escalation opportunities.

Description: VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.
Source: security@vmware.com
NVD status: Analyzed
Products: aria_operations, cloud_foundation, cloud_foundation_operations, open_vm_tools, telco_cloud_infrastructure, telco_cloud_platform, tools, debian_linux

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.8
Impact score: 5.9
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Known exploits

Data from CISA

Vulnerability name: Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability
Exploit added on: Oct 30, 2025
Exploit action due: Nov 20, 2025
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

security@vmware.com: CWE-267

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:vmware:aria_operations:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B78BDDD1-DE10-4839-9754-3A0D00F47986",
            "versionEndExcluding": "8.18.5",
            "versionStartIncluding": "8.0"
          },
          {
            "criteria": "cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D1B12C7E-0819-472E-8E79-477B47D603DD",
            "versionEndIncluding": "5.2.2",
            "versionStartIncluding": "4.0"
          },
          {
            "criteria": "cpe:2.3:a:vmware:cloud_foundation_operations:9.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "1A8C1A33-352A-4F7E-A284-F966F21EB0B3"
          },
          {
            "criteria": "cpe:2.3:a:vmware:open_vm_tools:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "3A809AD4-BFBA-4618-84A2-E638C13DC01F",
            "versionEndExcluding": "12.5.4",
            "versionStartIncluding": "11.2.0"
          },
          {
            "criteria": "cpe:2.3:a:vmware:open_vm_tools:13.0.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7F8B48DE-44C4-4581-A52F-5631B0EB33E6"
          },
          {
            "criteria": "cpe:2.3:a:vmware:telco_cloud_infrastructure:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "904AA81A-D1C3-4DAF-BB2C-C51FEDF5B3F6",
            "versionEndIncluding": "3.0",
            "versionStartIncluding": "2.2"
          },
          {
            "criteria": "cpe:2.3:a:vmware:telco_cloud_platform:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A9C444F9-5647-451F-B239-252841E440C7",
            "versionEndExcluding": "5.0.1",
            "versionStartIncluding": "4.0"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:vmware:tools:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "15832760-0347-4BB8-9B78-DE47CBE21957",
            "versionEndExcluding": "12.5.4",
            "versionStartIncluding": "12.5.0"
          },
          {
            "criteria": "cpe:2.3:a:vmware:tools:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "60F4C0D6-B650-4BE4-9E8F-DBFCFF7D8390",
            "versionEndExcluding": "13.0.5.0",
            "versionStartIncluding": "13.0.0.0"
          }
        ],
        "operator": "OR"
      },
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
          }
        ],
        "operator": "OR"
      }
    ],
    "operator": "AND"
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.