What’s Vulnerable › Vulnerabilities
CVE-2025-22226: VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability
- Severity: medium (CVSS 6.0 v3.1)
- Exploited in the wild: yes — in CISA KEV since 2025-03-04
- EPSS: 1.6% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-03-04 · updated 2026-06-17
- Weakness: CWE-125
Description
VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. A malicious actor with administrative privileges to a virtual machine may be able to exploit this issue to leak memory from the vmx process.
Summary
CVE-2025-22226 is an out-of-bounds read in VMware's HGFS that lets an attacker with administrative privileges inside a virtual machine leak memory from the vmx process, a medium-severity (CVSS 6) information disclosure. It affects VMware ESXi, Workstation (fixed in 17.6.3), Fusion (fixed in 13.6.3), Cloud Foundation, and Telco Cloud Infrastructure/Platform. CISA lists it as known exploited with active exploitation, so apply the vendor fixes or mitigations promptly, or discontinue use if none are available.
CVE-2025-22226 هو ثغرة قراءة خارج الحدود في HGFS في منتجات VMware، تتيح لجهة فاعلة خبيثة تملك صلاحيات إدارية داخل جهاز ظاهري تسريب ذاكرة من عملية vmx، وهي ثغرة كشف معلومات متوسطة الخطورة (CVSS 6). تؤثر في VMware ESXi وWorkstation (تم إصلاحها في 17.6.3) وFusion (تم إصلاحها في 13.6.3) وCloud Foundation وTelco Cloud Infrastructure/Platform. تُدرجها CISA ضمن الثغرات المعروفة المستغلة فعليًا، لذا طبّق إصلاحات المورّد أو التخفيفات فورًا، أو أوقف استخدام المنتج إن لم تتوفر معالجات.
Affected products
- VMware Cloud Foundation: all versions
- VMware ESXi: 7.0-beta, 7.0-update_1, 7.0-update_1a, 7.0-update_1b, 7.0-update_1c, 7.0-update_1d (+35); 7.0, 8.0
- VMware Fusion: from 13.0.0 before 13.6.3 — fixed in 13.6.3
- VMware Telco Cloud Infrastructure: 2.2, 2.5, 2.7, 3.0 (and their updates)
- VMware Telco Cloud Platform: 2.0, 2.5, 2.7, 3.0, 4.0, 4.0.1 (+1) (and their updates)
- VMware Workstation: from 17.0 before 17.6.3 — fixed in 17.6.3
- ESXi: from 8.0 before ESXi80U3d-24585383; from 8.0 before ESXi80U2d-24585300; from 7.0 before ESXi70U3s-24585291 — fixed in ESXi80U3d-24585383, ESXi80U2d-24585300, ESXi70U3s-24585291
- VMware Cloud Foundation: 5.x, 4.5.x
- VMware Fusion: from 13.x before 13.6.3 — fixed in 13.6.3
- VMware Telco Cloud Infrastructure: 3.x, 2.x
- VMware Telco Cloud Platform: 5.x, 4.x, 3.x, 2.x
- VMware Workstation: from 17.x before 17.6.3 — fixed in 17.6.3
How to fix
Upgrade to a fixed version: VMware Fusion 13.6.3; VMware Workstation 17.6.3; ESXi ESXi80U3d-24585383, ESXi80U2d-24585300, ESXi70U3s-24585291; VMware Fusion 13.6.3; VMware Workstation 17.6.3. Check the vendor advisory for mitigations.
References
- https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-22226
Get alerted when CVE-2025-22226 or the next vulnerability affects your stack