Critical Zero-day Vulnerabilities in VMware ESXi, Workstation, and Fusion
Broadcom has addressed three exploited vulnerabilities that, when chained, can allow an attacker to access the hypervisor through a running virtual machine
Summary
Broadcom has addressed three exploited vulnerabilities that, when chained, can allow an attacker to access the hypervisor through a running virtual machine
Affected platforms
The following platforms are known to be affected:
Threat details
All VMware ESX products affected
VMware's official advisory does not include all affected product versions. VMware's official advisory VMSA-2025-0004 includes a Response Matrix detailing the fixed releases for each product.
VMware have also released an FAQ detailing the following:
- You are affected if you are running any version of VMware ESX, VMware vSphere, VMware Cloud Foundation, or VMware Telco Cloud Platform prior to the versions listed as “fixed” in the VMSA.
- If there is any uncertainty about whether a system is affected, it should be presumed vulnerable, and immediate action should be taken.
- To ensure full protection for yourself and your organisation, install one of the update versions listed in the VMware Security Advisory.
Note: Products that are past their End of General Support dates are not evaluated as part of security advisories, and are not listed in the official VMSA.
Exploitation of CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226
Broadcom has stated exploitation of CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226 has been observed in the wild.
VMware applications have become a popular target for ransomware and data-extortion groups, and rapidly patching vulnerable software should be considered of critical importance.
The NHS England National Cyber Security Operations Centre assesses further exploitation as highly likely.
Introduction
Broadcom has released a critical security advisory addressing three vulnerabilities affecting VMware ESXi, Workstation, and Fusion, which are software hypervisor solutions.
Broadcom has stated the three vulnerabilities have been observed exploited in the wild.
Vulnerability Details
- CVE-2025-22224 is a 'heap-overflow' vulnerability affecting ESXI and Workstation, and has a CVSSv3 score of 9.3. If exploited, an attacker with local administrative privileges on a virtual machine (VM) could execute arbitrary code (ACE) as the VM's Virtual Machine Extension (VMX) process running on the host.
- CVE-2025-22225 is an 'arbitrary write' vulnerability affecting ESXi and has a CVSSv3 score of 8.2. If exploited, an attacker with privileges within the VMX process may trigger an arbitrary kernel write, leading to an escape of the sandbox.
- CVE-2025-22226 is an 'information disclosure' vulnerability affecting ESXi, Workstation, and Fusion, and has a CVSSv3 score of 7.1. If exploited, an attacker with administrative privileges on the VM may be able to leak memory from the VMX process.
Threat updates
| Date | Update |
|---|---|
| 6 Mar 2025 | Update to affected platforms to include VMware VSphere ESXi versions 6.5 and 6.7. Blue Box 'All VMware ESX products affected' added. |
Remediation advice
Affected organisations must review Broadcom advisory VMSA-2025-0004 and VMSA-2025-0004: Questions & Answers and apply the relevant updates.
Definitive source of threat updates
CVE Vulnerabilities
Last edited: 6 March 2025 3:33 pm