CVE-2025-41244
Published: 29 September 2025
Summary
CVE-2025-41244 is a high-severity Privilege Defined With Unsafe Actions (CWE-267) vulnerability in Vmware Open Vm Tools. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 30.6% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Timely application of Broadcom's patches for VMware Aria Operations and VMware Tools directly remediates the local privilege escalation vulnerability.
Least privilege limits non-administrative users' capabilities on the VM, reducing the feasibility and impact of privilege escalation to root.
Access enforcement mechanisms restrict unauthorized privilege elevations by local actors within the VM despite the vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local privilege escalation vulnerability directly enables exploitation for privilege escalation (T1068) from non-admin to root within the VM.
NVD Description
VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability…
more
to escalate privileges to root on the same VM.
Deeper analysisAI
CVE-2025-41244 is a local privilege escalation vulnerability in VMware Aria Operations and VMware Tools, classified under CWE-267 with a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Published on September 29, 2025, it allows escalation of privileges within affected virtual machines.
A malicious local actor with non-administrative privileges and access to a VM equipped with VMware Tools, where the Tools are installed and managed by Aria Operations with SDMP enabled, can exploit this vulnerability to elevate their privileges to root on the same VM. The attack requires low complexity and no user interaction, potentially compromising confidentiality, integrity, and availability at a high level.
Broadcom's security advisory VMSA-2025-0015 details updates for VMware Aria Operations and VMware Tools that address CVE-2025-41244 along with CVE-2025-41245 and CVE-2025-41246. Additional references include announcements on the oss-security mailing list, Debian LTS, and a technical analysis from NVISO Labs.
Details
- CWE(s)
- KEV Date Added
- 30 October 2025