What’s Vulnerable › Vulnerabilities
CVE-2025-22224: VMware ESXi and Workstation TOCTOU Race Condition Vulnerability
- Severity: high (CVSS 8.2 v3.1)
- Exploited in the wild: yes — in CISA KEV since 2025-03-04
- EPSS: 1.6% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-03-04 · updated 2026-06-17
- Weakness: CWE-367
Description
VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.
Summary
VMware ESXi and Workstation contain a TOCTOU race condition that leads to an out-of-bounds write. An attacker with local administrative privileges on a virtual machine can exploit it to execute code as the VMX process on the host, potentially compromising the hypervisor. The flaw affects VMware Cloud Foundation, ESXi, Telco Cloud Infrastructure, Telco Cloud Platform, and Workstation (fixed in 17.6.3). It is listed in CISA's Known Exploited Vulnerabilities catalog with active exploitation, so apply vendor mitigations promptly or discontinue use if none are available.
تحتوي منتجات VMware ESXi وWorkstation على ثغرة TOCTOU (سباق بين وقت الفحص ووقت الاستخدام) تؤدي إلى كتابة خارج الحدود. يمكن لجهة فاعلة خبيثة تمتلك صلاحيات إدارية محلية على جهاز ظاهري استغلالها لتنفيذ تعليمات برمجية بصلاحيات عملية VMX على المضيف، مما قد يعرّض الهايبرفايزر للاختراق. تشمل المنتجات المتأثرة VMware Cloud Foundation وESXi وTelco Cloud Infrastructure وTelco Cloud Platform وWorkstation (تم إصلاحها في 17.6.3). الثغرة مدرجة في كتالوج CISA للثغرات المعروفة بالاستغلال مع استغلال نشط، لذا يجب تطبيق إجراءات التخفيف من المورّد فوراً أو التوقف عن استخدام المنتج إذا لم تتوفر معالجات.
Affected products
- VMware Cloud Foundation: all versions
- VMware ESXi: 7.0-beta, 7.0-update_1, 7.0-update_1a, 7.0-update_1b, 7.0-update_1c, 7.0-update_1d (+35); 7.0, 8.0
- VMware Telco Cloud Infrastructure: 2.2, 2.5, 2.7, 3.0 (and their updates)
- VMware Telco Cloud Platform: 2.0, 2.5, 2.7, 3.0, 4.0, 4.0.1 (+1) (and their updates)
- VMware Workstation: from 17.0 before 17.6.3 — fixed in 17.6.3
- VMware Cloud Foundation: 5.x, 4.5.x
- VMware ESXi: from 8.0 before ESXi80U3d-24585383; from 8.0 before ESXi80U2d-24585300; from 7.0 before ESXi70U3s-24585291 — fixed in ESXi80U3d-24585383, ESXi80U2d-24585300, ESXi70U3s-24585291
- VMware Telco Cloud Infrastructure: 3.x, 2.x
- VMware Telco Cloud Platform: 5.x, 4.x, 3.x, 2.x
- VMware Workstation: from 17.x before 17.6.3 — fixed in 17.6.3
How to fix
Upgrade to a fixed version: VMware Workstation 17.6.3; VMware ESXi ESXi80U3d-24585383, ESXi80U2d-24585300, ESXi70U3s-24585291; VMware Workstation 17.6.3. Check the vendor advisory for mitigations.
References
- https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-22224
Get alerted when CVE-2025-22224 or the next vulnerability affects your stack