The Digital Security Authority (DSA) wants to bring to your attention a vulnerability affecting VMware .
Technical Details
Three actively exploited vulnerabilities in VMware ESXi, Workstation and Fusion products are being addressed in the latest security updates from Broadcom.
- CVE-2025-22224 (CVSS score: 9.3) - A Time-of-Check Time-of-Use (TOCTOU) vulnerability that enables an out-of-bounds write. With local admin rights a malicious actor on a VM could exploit this in order to execute code as the virtual machine's VMX process running on the host
- CVE-2025-22225 (CVSS score: 8.2) - An arbitrary write vulnerability that a can be exploited by a malicious actor with admin privileges within the VMX process potentially leading to a sandbox escape
- CVE-2025-22226 (CVSS score: 7.1) - An information disclosure vulnerability caused by an outof-bounds read in HGFS, which a malicious actor with administrative privileges in a VM may be able to exploit in order to leak memory from the VMX process
Affected Products:
- VMware ESXi 8.0 ESXi80U3d-24585383
- VMware ESXi 8.0 ESXi80U2d-24585300
- VMware ESXi 7.0 ESXi70U3s-24585291
- VMware Workstation 17.6.3
- VMware Fusion 13.6.3
- VMware Cloud Foundation 5.x, 4.5.x
- Telco Cloud Platform 5.x, 4.x, 3.x
Recommendations
The Digital Security Authority recommends updating the affected products version by applying the fixed release as its found in Broadcom support webpage.
References
The information presented in this report is based on available data up to the 6th of March 2025.