VMXNET3 out-of-bounds write vulnerability
Priority MEDIUM 41CWE-787Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.
Summary
VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Non VMXNET3 virtual adapters are not affected by this issue.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00192 8th percentileScored 2026-11-07
Fix Fixed ESX (VMware): ESXi-9.1.0.0200-25557999, ESXi-9.0.2.0100-25595025, ESXi80U3k-25595708
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| VMware | Cloud Foundation | 9.1.x.x; 9.0.x.x; 5.x | — | No fix listed | CNA |
| VMware | vSphere Foundation | 9.1.x.x; 9.0.x.x | — | No fix listed | CNA |
| VMware | ESX | 9.1.x.x to before ESXi-9.1.0.0200-25557999; 9.0.x.x to before ESXi-9.0.2.0100-25595025; 8.0 to before ESXi80U3k-25595708 | ESXi-9.1.0.0200-25557999, ESXi-9.0.2.0100-25595025, ESXi80U3k-25595708 | Patch available | CNA |
| VMware | Telco Cloud Platform | 5.1.x; 5.0.x | — | No fix listed | CNA |
- Cloud Foundation VendorVMware Affected 9.1.x.x; 9.0.x.x; 5.x Fixed in — No fix listed CNA
- vSphere Foundation VendorVMware Affected 9.1.x.x; 9.0.x.x Fixed in — No fix listed CNA
- ESX VendorVMware Affected 9.1.x.x to before ESXi-9.1.0.0200-25557999; 9.0.x.x to before ESXi-9.0.2.0100-25595025; 8.0 to before ESXi80U3k-25595708 Fixed in ESXi-9.1.0.0200-25557999, ESXi-9.0.2.0100-25595025, ESXi80U3k-25595708 Patch available CNA
- Telco Cloud Platform VendorVMware Affected 5.1.x; 5.0.x Fixed in — No fix listed CNA
Remediation
- Fix · CNA ESX (VMware) Fixed in ESXi-9.1.0.0200-25557999, ESXi-9.0.2.0100-25595025, ESXi80U3k-25595708
Timeline
- 2026-10-02 Threatist record created from CVE-2026-47876
- 2026-10-03 Alias added: GHSA-8f48-75j5-mrf7
References
More VMware vulnerabilities
- TI-2026-42442 vCenter directory-traversal vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2024-26040 Privilege escalation in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
- TI-2024-26039 Heap-overflow in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
- TI-2024-24610 Out-of-bounds write in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
- TI-2023-16914 VMware vCenter Server Out-of-Bounds Write Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2023-07303 Command injection in Aria Operations for Networks KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-47876 · CVE Program
- CVE-2026-47876 · NVD
- FIRST EPSS
- GHSA-8f48-75j5-mrf7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences