The vulnerability stems from an out‑of‑bounds read within VMware ESX, Workstation, and Fusion. An attacker who can deploy virtual machines can trigger the flaw, causing the host to read memory beyond a buffer’s boundary. This can expose sensitive host information and more typically destabilise the host process, resulting in a denial‑of‑service. The weakness is identified as CWE‑125.

Affected VMware products include Cloud Foundation, vSphere Foundation, ESX, Telco Cloud Platform, Workstation, and Fusion. No specific version list is provided, so any un‑patched installation of these products remains vulnerable.

The CVSS score of 7.6 classifies the vulnerability as high severity. The EPSS score of 0.00556 (<1%) and the fact that it is not listed in the CISA KEV catalog indicate that widespread exploitation is currently unlikely, though the probability is non‑zero. Attackers require virtual‑machine deployment privileges, limiting the threat to users with elevated configuration rights. Until an official fix is deployed, the risk to hosts with open deployment permissions remains moderate to high.