VMware fixed four vulnerabilities in VMware ESXi, Workstation, Fusion, and Tools that were exploited as zero-days during the Pwn2Own Berlin 2025 hacking contest in May 2025.

Three of the patched flaws have a severity rating of 9.3, as they allow programs running in a guest virtual machine to execute commands on the host. These flaws are tracked as CVE-2025-41236, CVE-2025-41237, and CVE-2025-41238.

These flaws are described in the security advisory as:

• CVE-2025-41236: VMware ESXi, Workstation, and Fusion contain an integer-overflow vulnerability in the VMXNET3 virtual network adapter. Nguyen Hoang Thach of STARLabs SG used this flaw at Pwn2Own.
• CVE-2025-41237: VMware ESXi, Workstation, and Fusion contain an integer-underflow in VMCI (Virtual Machine Communication Interface) that leads to an out-of-bounds write. This flaw was used by Corentin BAYET of REverse Tactics at Pwn2Own.
• CVE-2025-41238: VMware ESXi, Workstation, and Fusion contain a heap-overflow vulnerability in the PVSCSI (Paravirtualized SCSI) controller that leads to an out of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine’s VMX process running on the host. Thomas Bouzerar and Etienne Helluy-Lafont of Synacktiv at Pwn2Own used this flaw.

The fourth flaw, tracked as CVE-2025-41239, received a 7.1 rating as it is an information disclosure. It was also discovered by Corentin BAYET of REverse Tactics, who chained with CVE-2025-41237 during the hacking contest.

VMware has not provided any workarounds, and the only way to fix these vulnerabilities is to install the new versions of the software.

It should be noted that CVE-2025-41239 impacts VMware Tools for Windows, which requires a different upgrade process.

These vulnerabilities were demonstrated as zero-days during the Pwn2Own Berlin 2025 hacking contest, where security researchers collected $1,078,750 after exploiting 29 zero-day vulnerabilities.

VMware Workstation users report that the software’s automatic update functionality is broken after Broadcom redirected the download URL to its generic support page, triggering certificate errors.

The software contains a feature that checks for new updates on startup (if configured) and can be manually triggered by clicking Help > Software Updates. This will cause the program to connect to the software update server at https://softwareupdate.broadcom.com/cds to check for and download software updates.

However, this URL now redirects to Broadcom’s generic support page, https://support.broadcom.com/, causing the application to issue certificate validation errors and rendering its built-in update mechanism unusable.

“A certificate error occurred while connecting to the update server. Check your Internet settings or contact your system administrator,” reads the VMware Workstation error.

Users are now forced to log in and manually check Broadcom’s website for updates, download the correct version, and install it themselves, making it frustrating for customers who expect a seamless experience.

“To update your VMware Workstation Pro, you’ll need to manually download the latest installer from the Broadcom support portal. It’s worth noting that this change has caused frustration among users, as it was implemented without prior notice,” reads a post to the Broadcom community forums.

While VMware Workstation continues to function, this broken update system may cause users to miss important bug fixes or security patches, especially when it is not apparent that the automatic update feature is broken until you try to use it.

Broadcom has not yet issued a public statement or workaround for the issue, and BleepingComputer has confirmed it is still broken in VMware Workstation 17.6.3, the latest software version.

BleepingComputer contacted Broadcom with questions about the change but has not received a response.