CVE-2026-47876

Published Jul 30, 2026

Last updated 2 days ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-47876 is an out-of-bounds write vulnerability found in the VMXNET3 virtual network adapter within VMware ESX. This flaw allows an attacker with local administrative privileges on a virtual machine configured with the VMXNET3 adapter to execute code on the underlying ESX host. Successful exploitation of this vulnerability can lead to a virtual machine escape, compromising the isolation boundary between the guest VM and the host. The issue specifically impacts VMware ESX and related products that incorporate ESX, such as VMware Cloud Foundation and VMware vSphere Foundation. Virtual machines utilizing network adapters other than VMXNET3 are not affected by this particular vulnerability.

Description: VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Non VMXNET3 virtual adapters are not affected by this issue.
Source: security@vmware.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.3
Impact score: 6
Exploitability score: 2.5
Vector string: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

security@vmware.com: CWE-787

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 5

References