Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2025-41244

VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
vmware

Description

VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

VMware VCF operations

Default version status: unaffected

  • 9.0.x to < 9.0.1.0affected

VMware VMware tools

Default version status: unaffected

  • 13.x.x.x to < 13.0.5.0affected
  • 12.5.x to < 12.5.4affected

VMware VMware Aria Operations

Default version status: unaffected

  • 8.18.x to < 8.18.5affected

VMware VMware Cloud Foundation

Default version status: unaffected

  • 5.x to < 8.18.5affected
  • 4.x to < 8.18.5affected

VMware VMware Telco Cloud Platform

Default version status: unaffected

  • 5.x to < 8.18.5affected
  • 4.x to < 8.18.5affected

VMware VMware Telco Cloud Infrastructure

Default version status: unaffected

  • 3.x to < 8.18.5affected
  • 2.x to < 8.18.5affected

References