CVE-2025-62623 PUBLISHED

Assigner: AMD
Reserved: 16.10.2025 Published: 13.05.2026 Updated: 13.05.2026

A heap-based buffer overflow in the ionic cloud driver for VMware ESXi could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVSS Score: 8.8

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Local	Confidentiality	High	Confidentiality	High
Attack Complexity	High	Integrity	High	Integrity	High
Attack Requirements	None	Availability	High	Availability	High
Privileges Required	Low
User Interaction	None

CVSS 4.0

Product Status

Vendor	AMD
Product	ESXi 8.x and ESXi 9.x hosts using AMD-Pensando DPU products
Versions	Default: affected Version ESXi 8.0U3i, included in VCF 5.2.3.0 or 9.0.2 releases is unaffected

Credits

Reported through AMD Bug Bounty Program

References

https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-2001.html

Problem Types

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer CWE