IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
9.3Crítica KEV

CVE-2025-22224VMware ESXi and Workstation TOCTOU Race Condition Vulnerability

VMware ESXi; VMware Workstation; VMware VMware Cloud Foundation; VMware Telco Cloud Platform Publicada: (hace 1 año)

Explotación conocida — VMware ESXi and Workstation TOCTOU Race Condition Vulnerability

CISA confirmó el 04.03.2025 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 25.03.2025.

Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390 ; https://nvd.nist.gov/vuln/detail/CVE-2025-22224

Descripción

VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.

Debilidad (CWE): CWE-367

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
vmware cloud foundation —
VMware ESXi 8.0 – < ESXi80U3d-24585383, 8.0 – < ESXi80U2d-24585300, 7.0 – < ESXi70U3s-24585291
VMware Telco Cloud Infrastructure 3.x, 2.x
VMware Telco Cloud Platform 5.x, 4.x, 3.x, 2.x
VMware VMware Cloud Foundation 5.x, 4.5.x
VMware Workstation 17.x – < 17.6.3

Referencias y parches

Coincidencias CPE (NVD) (56)
  • cpe:2.3:o:vmware:esxi:7.0:-:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:7.0:beta:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:7.0:update_1:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:7.0:update_1a:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:7.0:update_1b:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:7.0:update_1c:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:7.0:update_1d:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:7.0:update_1e:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:7.0:update_2:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:7.0:update_2a:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:7.0:update_2c:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:7.0:update_2d:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:7.0:update_2e:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:7.0:update_3:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:7.0:update_3c:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:7.0:update_3d:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:7.0:update_3e:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:7.0:update_3f:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:7.0:update_3g:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:7.0:update_3i:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:7.0:update_3j:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:7.0:update_3k:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:7.0:update_3l:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:7.0:update_3m:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:7.0:update_3n:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:7.0:update_3o:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:7.0:update_3p:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:7.0:update_3q:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:7.0:update_3r:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:8.0:-:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:8.0:a:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:8.0:b:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:8.0:c:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:8.0:update_1:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:8.0:update_1a:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:8.0:update_1c:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:8.0:update_1d:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:8.0:update_2:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:8.0:update_2b:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:8.0:update_2c:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:8.0:update_3:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:8.0:update_3b:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:8.0:update_3c:*:*:*:*:*:*
  • cpe:2.3:a:vmware:cloud_foundation:-:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:telco_cloud_infrastructure:2.2:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:telco_cloud_infrastructure:2.5:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:telco_cloud_infrastructure:2.7:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:telco_cloud_infrastructure:3.0:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:telco_cloud_platform:2.0:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:telco_cloud_platform:2.5:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:telco_cloud_platform:2.7:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:telco_cloud_platform:3.0:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:telco_cloud_platform:4.0:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:telco_cloud_platform:4.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:telco_cloud_platform:5.0:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:workstation:*:*:*:*:*:*:*:* ≥ 17.0 < 17.6.3

CVE recientes del mismo producto — VMware ESXi / vCenter

2.7Baja
CVE-2026-41709 KEV

ESX insufficient logging vulnerability

VMware Cloud Foundation; VMware vSphere Foundation; VMware ESX; VMware Telco Cloud Platform

VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.

7.6Alta
CVE-2026-41703

Out-of-bounds read vulnerability

VMware Cloud Foundation; VMware vSphere Foundation; VMware ESX; VMware Workstation

VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability. A malicious actor with VM deployment privileges could trigger an out-of-bounds read, potentially leading to information disclosure or more likely a Denial-of-Service (DoS) condit…

9.3Crítica
CVE-2026-47876

VMXNET3 out-of-bounds write vulnerability

VMware Cloud Foundation; VMware vSphere Foundation; VMware ESX; VMware Telco Cloud Platform

VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the hos…

9.8Crítica
CVE-2026-59309

vCenter authentication-bypass vulnerability

VMware Cloud Foundation; VMware vSphere Foundation; VMware vCenter; VMware Telco Cloud Infrastructure

VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system.

9.8Crítica
CVE-2026-59310 KEV Usada en ransomware

vCenter directory-traversal vulnerability

VMware Cloud Foundation; VMware vSphere Foundation; VMware vCenter; VMware Telco Cloud Infrastructure

VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.

2.6%EPSS
8.0Alta
CVE-2026-41724

VMSA-2026-0004: VMware Cloud Foundation Operations updates address multiple vulnerabilities (CVE-2026-41722, CVE-2026-41723 and CVE-2026-41724)

VMware VCF operations; VMware VMware Aria Operations; VMware VMware Telco Cloud Platform

VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Founda…