9.3Critical KEV

CVE-2025-22224VMware ESXi and Workstation TOCTOU Race Condition Vulnerability

VMware ESXi; VMware Workstation; VMware VMware Cloud Foundation; VMware Telco Cloud Platform Published: 2025-03-04 14:56 (1 year ago)

Known exploited — VMware ESXi and Workstation TOCTOU Race Condition Vulnerability

CISA confirmed this vulnerability is used in real attacks on 04.03.2025. Remediation deadline for US federal agencies: 25.03.2025.

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390 ; https://nvd.nist.gov/vuln/detail/CVE-2025-22224

Description

VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.

Weakness (CWE): CWE-367

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
vmware	cloud foundation	—
VMware	ESXi	8.0 – < ESXi80U3d-24585383, 8.0 – < ESXi80U2d-24585300, 7.0 – < ESXi70U3s-24585291
VMware	Telco Cloud Infrastructure	3.x, 2.x
VMware	Telco Cloud Platform	5.x, 4.x, 3.x, 2.x
VMware	VMware Cloud Foundation	5.x, 4.5.x
VMware	Workstation	17.x – < 17.6.3

References and patches

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390 Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-22224 US Government Resource

CPE matches (NVD) (56)

cpe:2.3:o:vmware:esxi:7.0:-:*:*:*:*:*:*
cpe:2.3:o:vmware:esxi:7.0:beta:*:*:*:*:*:*
cpe:2.3:o:vmware:esxi:7.0:update_1:*:*:*:*:*:*
cpe:2.3:o:vmware:esxi:7.0:update_1a:*:*:*:*:*:*
cpe:2.3:o:vmware:esxi:7.0:update_1b:*:*:*:*:*:*
cpe:2.3:o:vmware:esxi:7.0:update_1c:*:*:*:*:*:*
cpe:2.3:o:vmware:esxi:7.0:update_1d:*:*:*:*:*:*
cpe:2.3:o:vmware:esxi:7.0:update_1e:*:*:*:*:*:*
cpe:2.3:o:vmware:esxi:7.0:update_2:*:*:*:*:*:*
cpe:2.3:o:vmware:esxi:7.0:update_2a:*:*:*:*:*:*
cpe:2.3:o:vmware:esxi:7.0:update_2c:*:*:*:*:*:*
cpe:2.3:o:vmware:esxi:7.0:update_2d:*:*:*:*:*:*
cpe:2.3:o:vmware:esxi:7.0:update_2e:*:*:*:*:*:*
cpe:2.3:o:vmware:esxi:7.0:update_3:*:*:*:*:*:*
cpe:2.3:o:vmware:esxi:7.0:update_3c:*:*:*:*:*:*
cpe:2.3:o:vmware:esxi:7.0:update_3d:*:*:*:*:*:*
cpe:2.3:o:vmware:esxi:7.0:update_3e:*:*:*:*:*:*
cpe:2.3:o:vmware:esxi:7.0:update_3f:*:*:*:*:*:*
cpe:2.3:o:vmware:esxi:7.0:update_3g:*:*:*:*:*:*
cpe:2.3:o:vmware:esxi:7.0:update_3i:*:*:*:*:*:*
cpe:2.3:o:vmware:esxi:7.0:update_3j:*:*:*:*:*:*
cpe:2.3:o:vmware:esxi:7.0:update_3k:*:*:*:*:*:*
cpe:2.3:o:vmware:esxi:7.0:update_3l:*:*:*:*:*:*
cpe:2.3:o:vmware:esxi:7.0:update_3m:*:*:*:*:*:*
cpe:2.3:o:vmware:esxi:7.0:update_3n:*:*:*:*:*:*
cpe:2.3:o:vmware:esxi:7.0:update_3o:*:*:*:*:*:*
cpe:2.3:o:vmware:esxi:7.0:update_3p:*:*:*:*:*:*
cpe:2.3:o:vmware:esxi:7.0:update_3q:*:*:*:*:*:*
cpe:2.3:o:vmware:esxi:7.0:update_3r:*:*:*:*:*:*
cpe:2.3:o:vmware:esxi:8.0:-:*:*:*:*:*:*
cpe:2.3:o:vmware:esxi:8.0:a:*:*:*:*:*:*
cpe:2.3:o:vmware:esxi:8.0:b:*:*:*:*:*:*
cpe:2.3:o:vmware:esxi:8.0:c:*:*:*:*:*:*
cpe:2.3:o:vmware:esxi:8.0:update_1:*:*:*:*:*:*
cpe:2.3:o:vmware:esxi:8.0:update_1a:*:*:*:*:*:*
cpe:2.3:o:vmware:esxi:8.0:update_1c:*:*:*:*:*:*
cpe:2.3:o:vmware:esxi:8.0:update_1d:*:*:*:*:*:*
cpe:2.3:o:vmware:esxi:8.0:update_2:*:*:*:*:*:*
cpe:2.3:o:vmware:esxi:8.0:update_2b:*:*:*:*:*:*
cpe:2.3:o:vmware:esxi:8.0:update_2c:*:*:*:*:*:*
cpe:2.3:o:vmware:esxi:8.0:update_3:*:*:*:*:*:*
cpe:2.3:o:vmware:esxi:8.0:update_3b:*:*:*:*:*:*
cpe:2.3:o:vmware:esxi:8.0:update_3c:*:*:*:*:*:*
cpe:2.3:a:vmware:cloud_foundation:-:*:*:*:*:*:*:*
cpe:2.3:a:vmware:telco_cloud_infrastructure:2.2:*:*:*:*:*:*:*
cpe:2.3:a:vmware:telco_cloud_infrastructure:2.5:*:*:*:*:*:*:*
cpe:2.3:a:vmware:telco_cloud_infrastructure:2.7:*:*:*:*:*:*:*
cpe:2.3:a:vmware:telco_cloud_infrastructure:3.0:*:*:*:*:*:*:*
cpe:2.3:a:vmware:telco_cloud_platform:2.0:*:*:*:*:*:*:*
cpe:2.3:a:vmware:telco_cloud_platform:2.5:*:*:*:*:*:*:*
cpe:2.3:a:vmware:telco_cloud_platform:2.7:*:*:*:*:*:*:*
cpe:2.3:a:vmware:telco_cloud_platform:3.0:*:*:*:*:*:*:*
cpe:2.3:a:vmware:telco_cloud_platform:4.0:*:*:*:*:*:*:*
cpe:2.3:a:vmware:telco_cloud_platform:4.0.1:*:*:*:*:*:*:*
cpe:2.3:a:vmware:telco_cloud_platform:5.0:*:*:*:*:*:*:*
cpe:2.3:a:vmware:workstation:*:*:*:*:*:*:*:* ≥ 17.0 < 17.6.3

CVSS score

9.3Critical

Source: vmware · CVSS 3.1

Attack vector: Local
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Changed
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

All scores (3)

cna	CVSS 3.1	9.3Critical
security@vmware.com	CVSS 3.1	9.3Critical
nvd	CVSS 3.1	8.2High

EPSS (chance of exploitation in 30 days)

1.56%

higher than 75% of all CVEs

CISA assessment (SSVC)

Exploitation: active
Automatable: no
Technical impact: total

Timeline

ID reserved2025-01-02
Published2025-03-04 14:56
Reached IP-DB2026-10-24 23:30
Added to KEV2025-03-04
Last updated2026-06-17 11:45

Assigned by (CNA): vmware
NVD status: Analyzed

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — VMware ESXi / vCenter

2.7Low

CVE-2026-41709 KEV 3 months ago

ESX insufficient logging vulnerability

VMware Cloud Foundation; VMware vSphere Foundation; VMware ESX; VMware Telco Cloud Platform

VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.

7.6High

CVE-2026-41703 3 months ago

Out-of-bounds read vulnerability

VMware Cloud Foundation; VMware vSphere Foundation; VMware ESX; VMware Workstation

VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability. A malicious actor with VM deployment privileges could trigger an out-of-bounds read, potentially leading to information disclosure or more likely a Denial-of-Service (DoS) condit…

9.3Critical

CVE-2026-47876 3 months ago

VMXNET3 out-of-bounds write vulnerability

VMware Cloud Foundation; VMware vSphere Foundation; VMware ESX; VMware Telco Cloud Platform

VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the hos…

9.8Critical

CVE-2026-59309 3 months ago

vCenter authentication-bypass vulnerability

VMware Cloud Foundation; VMware vSphere Foundation; VMware vCenter; VMware Telco Cloud Infrastructure

VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system.

9.8Critical

CVE-2026-59310 KEV Used in ransomware 3 months ago

vCenter directory-traversal vulnerability

VMware Cloud Foundation; VMware vSphere Foundation; VMware vCenter; VMware Telco Cloud Infrastructure

VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.

2.6%EPSS

8.0High

CVE-2026-41724 4 months ago

VMSA-2026-0004: VMware Cloud Foundation Operations updates address multiple vulnerabilities (CVE-2026-41722, CVE-2026-41723 and CVE-2026-41724)

VMware VCF operations; VMware VMware Aria Operations; VMware VMware Telco Cloud Platform

VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Founda…