A security engineer at a cloud hosting company is reviewing an incident where an attacker who controlled one tenant's virtual machine was able to execute code directly on the underlying host and access memory belonging to other tenants' VMs on the same physical server. Which type of vulnerability was exploited?