ZDI 2026-03-30

ZDI-26-232: (Pwn2Own) Red Hat Enterprise Linux vmwgfx Driver Integer Overflow Local Privilege Escalation Vulnerability

CVE-2025-40277

Machine-generated analysis · WAYSCloud LLM

The vulnerability is an integer overflow in the vmwgfx driver, which is part of the Red Hat Enterprise Linux kernel graphics subsystem.

Context

The affected component is the vmwgfx driver in Red Hat Enterprise Linux. The vulnerability is an integer overflow that can be exploited by a local attacker to escalate privileges. Exploitation requires prior access to execute low-privileged code on the system. The ZDI assigned a CVSS score of 8.8, indicating high severity according to their rating system.

Operator considerations

Check: inventory Red Hat Enterprise Linux systems using the vmwgfx driver, particularly in virtualized environments with graphical workloads.

From Zero Day Initiative ↗

This vulnerability allows local attackers to escalate privileges on affected installations of Red Hat Enterprise Linux. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2025-40277.

Read the full advisory on ZDI →