VMware ESXi / Workstation: TOCTOU race leading to an out-of-bounds write in VMX - full VM escape to host code execution

Impact

TOCTOU race leading to an out-of-bounds write in VMX - full VM escape to host code execution; exploited in the wild as a zero-day [KEV]

Who can reach it

Tenant VM guest (local admin inside the VM)

What to do

ESXi patch + host reboot with vMotion evacuation. GPU-passthrough VMs cannot vMotion, so this is a tenant-visible drain. Top-priority escape of the 2025 set

References

Related entries

• VMware ESXi / Workstation / Fusion: Integer overflow in the VMXNET3 virtual NICCVE-2025-41236 · VMware ESXi / Workstation / FusionCritical
• VMware ESXi / Workstation / Fusion: Integer underflow in VMCI leading to an out-of-bounds writeCVE-2025-41237 · VMware ESXi / Workstation / FusionCritical
• VMware ESXi / Workstation / Fusion: Heap overflow in the PVSCSI controllerCVE-2025-41238 · VMware ESXi / Workstation / FusionCritical
• Intel Data Center GPU driver for VMware ESXi (buffer overflow): A buffer overflow in the Intel datacenter graphicsCVE-2026-20794 · Intel Data Center GPU driver for VMware ESXi (buffer overflow)Critical
• KVM arm64 vgic-its: double reference drop on the ITS translation cache frees an in-use interruptCVE-2026-46316 · Linux kernel KVM arm64 vgic-its (interrupt translation cache invalidation)Critical
• PREVAIL eBPF verifier: stale offset tracking lets out-of-bounds BPF programs pass verificationCVE-2026-53670 · PREVAIL eBPF verifier (EbpfTransformer::add offset tracking)Critical