CVE-2025-41244

NameCVE-2025-41244
DescriptionVMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-4316-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
open-vm-tools (PTS)bookworm2:12.2.0-1+deb12u4fixed
bookworm (security)2:12.2.0-1+deb12u3vulnerable
trixie2:12.5.0-2+deb13u1fixed
forky, sid2:13.0.10-1.1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
open-vm-toolssourcebullseye2:11.2.5-2+deb11u5DLA-4316-1
open-vm-toolssourcebookworm2:12.2.0-1+deb12u4
open-vm-toolssourcetrixie2:12.5.0-2+deb13u1
open-vm-toolssource(unstable)2:13.0.5-1

Notes

https://github.com/vmware/open-vm-tools/tree/CVE-2025-41244.patch
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36149
Search for package or bug name: Reporting problems