CVE-2025-22224: critical vulnerability in VMware ESXi
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA and has an official Brazilian government alert.
Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.
- CTIR Gov · ALERTA 04/2025Vulnerabilidades em produtos VMware.read on gov.br ↗
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
VMware ESXi and Workstation have a race condition flaw that allows someone with admin access to a virtual machine to write data outside allowed memory bounds, potentially letting them run malicious code on the host system.
A TOCTOU vulnerability in VMware ESXi and Workstation permits out-of-bounds memory writes when a window exists between privilege validation and memory access. An attacker with local administrative privileges within a guest VM can exploit this race condition to achieve arbitrary code execution in the VMX process on the host, breaching VM isolation.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.