Skip to content
OpenAdvisories
High 1 exploited CVE ALAS2023-2025-1226 1 CVE

Important: open-vm-tools security update (Amazon Linux 2023)

Published Oct 14, 2025 · Updated Oct 14, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-41244: VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.

Fixed packages 11

ReleasePackageFixed in
Amazon Linux · 2023 open-vm-tools 0:12.3.0-1.amzn2023.0.5
Amazon Linux · 2023 open-vm-tools-debuginfo 0:12.3.0-1.amzn2023.0.5
Amazon Linux · 2023 open-vm-tools-debugsource 0:12.3.0-1.amzn2023.0.5
Amazon Linux · 2023 open-vm-tools-desktop 0:12.3.0-1.amzn2023.0.5
Amazon Linux · 2023 open-vm-tools-desktop-debuginfo 0:12.3.0-1.amzn2023.0.5
Amazon Linux · 2023 open-vm-tools-devel 0:12.3.0-1.amzn2023.0.5
Amazon Linux · 2023 open-vm-tools-salt-minion 0:12.3.0-1.amzn2023.0.5
Amazon Linux · 2023 open-vm-tools-sdmp 0:12.3.0-1.amzn2023.0.5
Amazon Linux · 2023 open-vm-tools-sdmp-debuginfo 0:12.3.0-1.amzn2023.0.5
Amazon Linux · 2023 open-vm-tools-test 0:12.3.0-1.amzn2023.0.5
Amazon Linux · 2023 open-vm-tools-test-debuginfo 0:12.3.0-1.amzn2023.0.5

Vulnerabilities 1

  • High 7.8
    CVE-2025-41244 Exploited Public exploit EPSS 16%

    VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246)

    VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may explo…

    VMware VMware Aria Operations VMware Telco Cloud Platform VMware Cloud Foundation Debian Ubuntu Azure Linux
    KEV Oct 30, 2025

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-41244.html