VMware has released security updates to address multiple vulnerabilities affecting ESXi, Workstation, and Fusion. These flaws, tracked as CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226, enable attackers to execute arbitrary code, escape the virtual machine sandbox, and leak sensitive memory data. Exploitation of these vulnerabilities has been observed in the wild.
Affected Products:
- VMware ESXi (versions 7.0, 8.0)
- VMware Workstation (version 17.x)
- VMware Fusion (version 13.x)
- VMware Cloud Foundation (versions 4.x, 5.x)
- VMware Telco Cloud Platform (versions 2.x, 3.x, 4.x, 5.x)
- VMware Telco Cloud Infrastructure (versions 2.x, 3.x)
Vulnerability Details:
- CVE-2025-22224 – VMCI Heap Overflow (CVSS 9.3 – Critical)
- A Time-of-Check to Time-of-Use (TOCTOU) issue in VMware ESXi and Workstation leads to an out-of-bounds write.
- Attackers with local administrative access to a virtual machine can exploit this to execute arbitrary code as the VMX process on the host.
- No workarounds are available. Patching is required.
- CVE-2025-22225 – ESXi Arbitrary Write (CVSS 8.2 – High)
- A flaw in ESXi allows attackers with access to the VMX process to write arbitrary data to kernel memory, leading to potential sandbox escapes.
- No workarounds exist. Updating to the fixed version is required.
- CVE-2025-22226 – HGFS Information Disclosure (CVSS 7.1 – High)
- An out-of-bounds read in the HGFS file-sharing feature of ESXi, Workstation, and Fusion allows attackers with administrative VM access to leak memory contents.
- No workarounds exist. Affected systems should be updated.
Confirmed Exploitation
VMware has confirmed the active exploitation of these vulnerabilities. Organizations using affected products should prioritize patching.
Fixed Versions:
VMware has released the following patched versions:
| Product | Fixed Version |
| ESXi 8.0 | ESXi80U3d-24585383, ESXi80U2d-24585300 |
| ESXi 7.0 | ESXi70U3s-24585291 |
| Workstation 17.x | 17.6.3 |
| Fusion 13.x | 13.6.3 |
| Cloud Foundation 5.x, 4.5.x | Async patch to latest ESXi updates |
| Telco Cloud Platform | KB389385 |
| Telco Cloud Infrastructure | KB389385 |
Recommended Actions:
- Apply security patches immediately using the fixed versions listed.
- Check for potential exploitation if your organization uses vulnerable versions.
- Monitor VMware’s security advisories for additional updates or mitigations.