Hypervisor memory disclosure via vmxnet3 heap overflow

Heap overflow in VMware ESXi, Workstation, and Fusion allows local users in a vmxnet3-equipped guest to read hypervisor memory. The vendor identifies the locus as vmxnet3 but publishes no triggering input, allocation error, or bounds-check failure explaining how guest traffic overruns heap storage. The attacker requires access to a guest with vmxnet3 present, low privileges suffice, and additional conditions outside the attacker's control must align; impact is limited to disclosure.