CVE-2025-41244
EUVD-2025-3158929.09.2025, 17:15
VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| vmware | aria_operations | 8.0 ≤ 𝑥 < 8.18.5 |
| vmware | cloud_foundation | 4.0 ≤ 𝑥 ≤ 5.2.2 |
| vmware | cloud_foundation_operations | 9.0 |
| vmware | open_vm_tools | 11.2.0 ≤ 𝑥 < 12.5.4 |
| vmware | open_vm_tools | 13.0.0 |
| vmware | telco_cloud_infrastructure | 2.2 ≤ 𝑥 ≤ 3.0 |
| vmware | telco_cloud_platform | 4.0 ≤ 𝑥 < 5.0.1 |
| debian | debian_linux | 11.0 |
| vmware | tools | 12.5.0 ≤ 𝑥 < 12.5.4 |
| vmware | tools | 13.0.0.0 ≤ 𝑥 < 13.0.5.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
openSUSE / SLES Releases
openSUSE Product | |||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| libvmtools-devel |
| ||||||||||||||||||||||||||||
| libvmtools0 |
| ||||||||||||||||||||||||||||
| open-vm-tools |
| ||||||||||||||||||||||||||||
| open-vm-tools-containerinfo |
| ||||||||||||||||||||||||||||
| open-vm-tools-desktop |
| ||||||||||||||||||||||||||||
| open-vm-tools-salt-minion |
| ||||||||||||||||||||||||||||
| open-vm-tools-sdmp |
|
Red Hat Enterprise Linux Releases
Red Hat Product | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| open-vm-tools |
| ||||||||||||||||
| open-vm-tools-desktop |
| ||||||||||||||||
| open-vm-tools-salt-minion |
| ||||||||||||||||
| open-vm-tools-sdmp |
| ||||||||||||||||
| open-vm-tools-test |
|
Common Weakness Enumeration
References