9.3
Critique
Exploitée
CVE-2025-22224 VMware ESXi and Workstation TOCTOU Race Condition Vulnerability
Exploitation active constatée
· catalogue CISA KEV
Action attendue
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Campagnes de rançongiciel
Non constatée à ce jour
Faiblesse
CWE-367
Description
VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| ESXi 8.0 | 8.0 → dernières | Pas de correctif indiqué |
| ESXi 7.0 | 7.0 → dernières | Pas de correctif indiqué |
| Workstation 17 | 17.x → < 17.6.3 | 17.6.3 |
| VMware Cloud Foundation | Versions non publiées | |
| Telco Cloud Platform | Versions non publiées | |
| Telco Cloud Infrastructure | Versions non publiées |
Références
- support.broadcom.com support.broadcom.com
Chronologie
- Publiée
- Ajoutée au catalogue KEV
- Dernière modification
Autres CVE de ESXi
Les 29 CVE de ESXi →
CVE-2025-41239
VMware ESXi, Workstation, Fusion, and VMware Tools contains an information disclosure vulnerability due to the usage…
7.1
Élevée
CVE-2025-41238
VMware ESXi, Workstation, and Fusion contain a heap-overflow vulnerability in the PVSCSI (Paravirtualized SCSI)…
9.3
Critique
CVE-2025-41237
VMCI integer-underflow vulnerability
9.3
Critique
CVE-2025-41236
VMware ESXi, Workstation, and Fusion contain an integer-overflow vulnerability in the VMXNET3 virtual network adapter. A…
9.3
Critique