Description
A heap-based buffer overflow in the ionic cloud driver for VMware ESXi could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution.
Published: 2026-05-13
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A heap-based buffer overflow in the ionic cloud driver for VMware ESXi allows an attacker to gain elevated privileges, potentially culminating in arbitrary code execution. The flaw arises within the driver's memory handling, which can be exploited to overwrite critical control data.

Affected Systems

AMD:ESXi 8.x and ESXi 9.x hosts that use AMD‑Pensando DPU products are affected. No specific sub‑versions are listed, but all releases of the specified host versions that include the ionic cloud driver are vulnerable.

Risk and Exploitability

The CVSS score of 8.8 indicates a high severity. EPSS data is not available, so the current exploitation probability is uncertain. The vulnerability is not included in the CISA KEV catalog, but its impact level warrants immediate attention. Attackers would need to target the specific ESXi hosts equipped with the affected DPU drivers; the exact attack vector is not disclosed in the advisory.

Generated by OpenCVE AI on May 13, 2026 at 04:52 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Obtain and apply the latest AMD‑Pensando DPU firmware update that addresses the ionic cloud driver heap overflow.
  • Upgrade VMware ESXi to the latest supported release that incorporates the vendor patch.
  • Restrict administrative access to the ESXi host and monitor driver activity for anomalous behavior.

Generated by OpenCVE AI on May 13, 2026 at 04:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 13 May 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 13 May 2026 11:00:00 +0000

Type Values Removed Values Added
First Time appeared Amd
Amd esxi 8.x And Esxi 9.x Hosts Using Amd-pensando Dpu Products
Vendors & Products Amd
Amd esxi 8.x And Esxi 9.x Hosts Using Amd-pensando Dpu Products

Wed, 13 May 2026 05:15:00 +0000

Type Values Removed Values Added
Title Heap Overflow in VMware ESXi Ionic Cloud Driver Enables Privilege Escalation

Wed, 13 May 2026 03:30:00 +0000

Type Values Removed Values Added
Description A heap-based buffer overflow in the ionic cloud driver for VMware ESXi could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution.
Weaknesses CWE-119
References
Metrics cvssV4_0

{'score': 8.8, 'vector': 'CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

Subscriptions

Amd Esxi 8.x And Esxi 9.x Hosts Using Amd-pensando Dpu Products
cve-icon MITRE

Status: PUBLISHED

Assigner: AMD

Published:

Updated: 2026-05-14T14:38:16.890Z

Reserved: 2025-10-16T20:46:13.455Z

Link: CVE-2025-62623

cve-icon Vulnrichment

Updated: 2026-05-13T14:38:22.616Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-05-13T04:17:35.217

Modified: 2026-05-13T14:49:11.830

Link: CVE-2025-62623

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-13T10:35:03Z

Weaknesses