CVE-2025-62627 PUBLISHED

Assigner: AMD
Reserved: 16.10.2025 Published: 13.05.2026 Updated: 13.05.2026

An untrusted pointer dereference in the ionic cloud driver for VMWare ESXi could allow an attacker with an unprivileged VM to read kernel memory or co-located guest VM memory, potentially resulting in loss of confidentiality or availability.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:H/SC:H/SI:L/SA:H
CVSS Score: 7.2

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Local	Confidentiality	High	Confidentiality	High
Attack Complexity	High	Integrity	Low	Integrity	Low
Attack Requirements	None	Availability	High	Availability	High
Privileges Required	Low
User Interaction	None

CVSS 4.0

Product Status

Vendor	AMD
Product	ESXi 8.x and ESXi 9.x hosts using AMD-Pensando DPU products
Versions	Default: affected Version ESXi 8.0U3i, included in VCF 5.2.3.0 or 9.0.2 releases is unaffected

Credits

Reported through AMD Bug Bounty Program

References

https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-2001.html

Problem Types

CWE-822 Untrusted Pointer Dereference CWE