VMware Products Information Disclosure Vulnerability in HGFS

An information disclosure vulnerability has been identified in VMware ESXi, Workstation, and Fusion. This vulnerability arises from an out-of-bounds read in HGFS, which could be exploited by a malicious actor with administrative privileges to a virtual machine. The exploitation may lead to the leakage of memory from the vmx process.

Impact

Exploitation of this vulnerability could result in unauthorized memory leakage from the vmx process, potentially leading to the exposure of sensitive information.

Remediation

Users can apply the patches available in the 'Fixed Version' column of the 'Response Matrix' found in the VMware Security Advisory VMSA-2025-0004. Instructions for downloading the patch are also available in this advisory.