26/03/2025
VMware vulnerabilities being exploited by hackers (CVE-2025-22224, CVE-2025-22225, CVE-2025-22226)
Attention All,
VMware reported vulnerabilities affecting products from technology giant VMware after the company confirmed the bugs are being exploited by hackers. VMware published an advisory to warning customers of CVE-2025-22224, CVE-2025-22225, CVE-2025-22226 — three bugs impacting the company’s popular ESXi, Workstation and Fusion products.
Impacted Products
VMware ESXi
VMware Workstation Pro / Player (Workstation)
VMware Fusion
VMware Cloud Foundation
VMware Telco Cloud Platform
Introduction
Multiple vulnerabilities in VMware ESXi, Workstation, and Fusion were privately reported to VMware. Updates are available to remediate these vulnerabilities in affected VMware products.
a. VMCI heap-overflow vulnerability (CVE-2025-22224)
Description: VVMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write.
Known Attack Vectors: A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.
Resolution: To remediate CVE-2025-22224 apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' found below.
Workarounds: None.
b. VMware ESXi arbitrary write vulnerability (CVE-2025-22225)
Description: VMware ESXi contains an arbitrary write vulnerability.
Known Attack Vectors: A malicious actor with privileges within the VMX process may trigger an arbitrary kernel write leading to an escape of the sandbox.
Resolution: To remediate CVE-2025-22225 apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' found below.
Workarounds: None.
C. HGFS information-disclosure vulnerability (CVE-2025-22226)
Description: VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS.
Known Attack Vectors: A malicious actor with administrative privileges to a virtual machine may be able to exploit this issue to leak memory from the vmx process.
Resolution: To remediate CVE-2025-22226 apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' found below.
Workarounds: None.
References:
CISA, VMware warn of new vulnerabilities being exploited by hackers | The Record from Recorded Future News
Support Content Notification - Support Portal - Broadcom support portal
