Pwn2Own VMware Hypervisor Escape and Privilege Escalation Vulnerabilities

Broadcom VMware issued fixes for multiple Pwn2Own-disclosed local privilege escalation flaws affecting ESXi and Workstation, where attackers with code execution inside a guest can potentially execute arbitrary code in the hypervisor context. The disclosed issues include CVE-2025-41236 in the VMXNET3 virtual device on ESXi, caused by an integer overflow; CVE-2025-41237 in VMCI on ESXi, caused by an integer underflow; and CVE-2025-41238 in the PVSCSI virtual device on Workstation, caused by improper validation of user-controlled length data leading to a heap-based buffer overflow. All three advisories assign a CVSS 8.2 score and describe the same exploitation precondition: the attacker must already be able to run high-privileged code on the guest OS.

The Aria Operations privilege-escalation research is a different VMware product issue and does not describe the same disclosure set. That separate report covers CVE-2025-41245 and CVE-2026-22721, where a vCenter user mapped by default to Aria’s PowerUser role could escalate to an Aria administrator and potentially gain access across integrated VMware environments. By contrast, the relevant Pwn2Own advisories focus specifically on guest-to-hypervisor escape paths in ESXi and Workstation, with Broadcom publishing updates through the same security advisory channel and crediting researchers from STAR Labs, Synacktiv, and REverse Tactics for the findings.