A heap-based buffer overflow exists in the ionic cloud driver used by VMware ESXi hosts that incorporate AMD‑Pensando DPU products. The flaw is categorized as CWE‑122 and can be exploited by an attacker from within the host environment to gain higher privileges, potentially leading to arbitrary code execution. The vulnerability does not require remote code submission; it exploits memory corruption that alters control flow within the privileged driver context. Consequently, any compromised host could be used as a pivot to attack other network segments or services running on the same ESXi host.

The flaw affects AMD‑Pensando DPU‑enabled VMware ESXi 8.x and ESXi 9.x hosts. Specific model or firmware version numbers are not provided in the advisory, so all hosts that employ the ionic cloud driver should be considered vulnerable until a vendor update is applied.

The CVSS base score of 8.8 indicates a high severity. The EPSS score is unavailable, but the lack of a known public exploit and absence from the CISA KEV catalog suggest a moderate exploitation likelihood. Based on the description, it is inferred that the attack vector is local, requiring interaction with the ionic cloud driver. Once exploited, the attacker can achieve system‑level privileges and execute arbitrary code on the host.