Skip to content
OpenAdvisories
High 1 exploited CVE USN-7785-1 1 CVE

open-vm-tools vulnerability

Published Sep 29, 2025 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Open VM Tools incorrectly handled permissions with
version checking. An attacker could possibly use this issue to escalate
privileges inside a virtual machine.

This update disables the SDMP get-versions.sh script, so version
information may no longer be made available.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS open-vm-tools 2:12.3.5-3~ubuntu0.22.04.3
Ubuntu · 24.04 LTS 24.04:LTS open-vm-tools 2:12.5.0-1~ubuntu0.24.04.2
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS open-vm-tools 2:11.3.0-2ubuntu0~ubuntu20.04.8+esm1

Vulnerabilities 1

  • High 7.8
    CVE-2025-41244 Exploited Public exploit EPSS 16%

    VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246)

    VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may explo…

    VMware VMware Aria Operations VMware Telco Cloud Platform VMware Cloud Foundation Debian Ubuntu Azure Linux
    KEV Oct 30, 2025

References

  • report
    https://ubuntu.com/security/CVE-2025-41244