Broadcom Patches VMware Flaws: Privilege Escalation and Info Disclosure Vulnerabilities Affect VMware Tools and Aria Operations

Broadcom has released patches addressing three vulnerabilities in VMware Aria Operations and VMware Tools, with severities ranging from Moderate to Important, affecting a broad range of VMware products including VMware Cloud Foundation, VMware Telco Cloud Platform and VMware Telco Cloud Infrastructure.

CVE-2025-41244 is a local privilege escalation vulnerability that could allow a malicious local actor with non-administrative privileges to escalate to root on the same VM running VMware Tools managed by Aria Operations with SDMP enabled. CVE-2025-41245 is an information disclosure issue in Aria Operations that could enable a malicious actor with non-administrative privileges to disclose credentials of other Aria Operations users, with fixes in Aria Operations 8.18.5 and related platform updates.

CVE-2025-41246 involves an improper authorisation vulnerability in VMware Tools for Windows, potentially allowing a malicious actor with non-administrative privileges on a guest VM to access other guest VMs, with patches in VMware Tools 13.0.5 and 12.5.4. Patches are available for VMware Aria Operations (8.x, 5.x, 4.x, 3.x, 2.x) and VMware Tools (13.x, 12.x, 11.x for Windows/Linux), and organisations are urged to update to the specified versions immediately. The fixes were reported by Maxime Thiebaut of NVISO and by Sven Nobis and Lorin Lehawany of ERNW GmbH.