Description 此信息泄露漏洞源于在 vSockets 中使用未初始化的内存。攻击者必须拥有虚拟机的本地管理权限才能利用此漏洞。成功利用此漏洞可能导致与 vSockets 通信的进程发生内存泄漏。
References https://avd.aliyun.com/detail?id=AVD-2025-41239 https://stack.chaitin.com/vuldb/detail/b9755b85-ffe8-4458-8686-b59cc9321b38 https://www.sentinelone.com/vulnerability-database/cve-2025-41239/ https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/35877 https://nvd.nist.gov/vuln/detail/CVE-2025-41239 https://github.com/advisories/GHSA-8p72-rxh7-qv97 https://www.tenable.com/plugins/nessus/247827 https://threatprotect.qualys.com/2025/07/16/vmware-esxi-workstation-fusion-and-tools-multiple-vulnerabilities-cve-2025-41236-cve-2025-41237-cve-2025-41238-cve-2025-41239/
Related VulnerabilitiesPoCCVE-2026-86206: N-able N-central - Access Control Bypass via Path Confusion and Forwarded Header SpoofingVMware ESXi /sdk 默认口令漏洞PoCCVE-2026-63030: WordPress Core 6.9-7.0.1 - Pre-Auth Batch-Route ConfusionPoCCVE-2026-8713: Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File DeletionPoCCVE-2026-48282: Adobe ColdFusion - RDS Arbitrary File WritePoCCVE-2026-48313: ColdFusion - Path TraversalTRUfusion Enterprise /trufusionPortal/getProjectList 权限绕过漏洞(CVE-2025-27223)PoCCVE-2024-38773: FormLift for Infusionsoft Web Forms <= 7.5.17 - SQL InjectionPoCTRUfusion Enterprise /trufusionPortal/getCobrandingData 文件读取漏洞(CVE-2025-27222)PoCCVE-2025-32355: Rocket TRUfusion Enterprise - Server Side Request ForgeryPoCCVE-2022-31678: VMWare Cloud Foundation NSX-V - XML External Entity (XXE)PoCcoldfusion-cfide-dir-listing: Adobe ColdFusion CFIDE - Directory ListingPoCCVE-2018-6961: VMware NSX SD-WAN Edge - Command Injection