9.3
Critical
Exploited
CVE-2025-22224 VMware ESXi and Workstation TOCTOU Race Condition Vulnerability
Active exploitation observed
· CISA KEV catalogue
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Ransomware campaigns
Not observed so far
Weakness
CWE-367
Description
VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| ESXi 8.0 | 8.0 → latest | No fix stated |
| ESXi 7.0 | 7.0 → latest | No fix stated |
| Workstation 17 | 17.x → < 17.6.3 | 17.6.3 |
| VMware Cloud Foundation | Versions not published | |
| Telco Cloud Platform | Versions not published | |
| Telco Cloud Infrastructure | Versions not published |
References
- support.broadcom.com support.broadcom.com
Timeline
- Published
- Added to the KEV catalogue
- Last modified
Other CVEs of ESXi
The 29 CVEs of ESXi →
CVE-2025-41239
VMware ESXi, Workstation, Fusion, and VMware Tools contains an information disclosure vulnerability due to the usage…
7.1
High
CVE-2025-41238
VMware ESXi, Workstation, and Fusion contain a heap-overflow vulnerability in the PVSCSI (Paravirtualized SCSI)…
9.3
Critical
CVE-2025-41237
VMCI integer-underflow vulnerability
9.3
Critical
CVE-2025-41236
VMware ESXi, Workstation, and Fusion contain an integer-overflow vulnerability in the VMXNET3 virtual network adapter. A…
9.3
Critical