Local Privilege Escalation in VMware Aria Operations and VMware Tools Service Discovery

CVE-2025-41244 is a local privilege escalation vulnerability affecting VMware Aria Operations, VMware Tools, and open-vm-tools on Linux guest VMs. The flaw is associated with VMware guest service discovery functionality, including Aria Operations Service Discovery Management Pack (SDMP) workflows and VMware Tools metrics/service discovery routines. Available reporting indicates the vulnerable logic is implemented in service discovery code such as get-versions.sh, which identifies services by matching process command lines against regular expressions and then executes the matched binary with version arguments. Overly broad matching, including use of patterns that can match attacker-controlled paths, creates an untrusted search path condition. As a result, an unprivileged local user can place a malicious executable in a writable location such as /tmp using a name that matches expected service binaries (for example, /tmp/httpd), run it so it appears in process listings with a listening socket, and cause the privileged VMware discovery component to execute it. In credential-based SDMP mode, the vulnerable execution path is in Aria Operations; in credential-less mode, the vulnerable execution path is in VMware Tools/open-vm-tools. Successful exploitation results in execution in a privileged context, typically root, on the same guest VM.