CVE-2025-22224: VMware ESXi and Workstation TOCTOU race leads to out-of-bounds write

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw allows hypervisor escape with high confidentiality, integrity, and availability impact and is confirmed exploited in CISA KEV, though it requires local admin privileges in a guest VM.

What it is

VMware ESXi, Workstation, and related products contain a TOCTOU race condition that results in an out-of-bounds write. An attacker with local administrative privileges inside a guest VM can leverage the flaw to run code in the VMX process on the host, crossing the hypervisor boundary. The issue is listed in CISA's KEV catalog, so it is being exploited in the wild.

Impact

Successful exploitation gives the attacker code execution as the VMX process on the ESXi host, escaping the guest VM boundary. From there the attacker can compromise the host and potentially other VMs it runs.

Attack surface

The vector is local (AV:L) with high privileges required (PR:H) and no user interaction (UI:N), meaning the attacker must already hold administrative rights inside a guest virtual machine. No remote or unauthenticated path is described in the record.

Exploitation

CVE-2025-22224 was added to CISA KEV on 2025-03-04 with a remediation due date of 2025-03-25, confirming known exploitation. EPSS is 0.01561 (73.98th percentile), and CISA records no known ransomware campaign use.

What to do

• Apply the vendor patch from the Broadcom/VMware security advisory for ESXi, Workstation, Cloud Foundation, Telco Cloud Infrastructure, and Telco Cloud Platform.
• If patching cannot be done immediately, follow the vendor's interim mitigations or discontinue use of the affected product per CISA BOD 22-01 guidance.
• Restrict and audit administrative access to guest VMs, since exploitation requires local admin privileges inside a VM.
• Segment and harden ESXi management interfaces, and monitor for unexpected VMX process behavior on hosts.

Detection

• Monitor ESXi host logs and VMX process activity for unexpected crashes, restarts, or anomalous child processes.
• Alert on unusual guest-to-host interactions or VM escape indicators in hypervisor telemetry.
• Track patch status of ESXi, Workstation, and Cloud Foundation assets against the vendor advisory.
• Review authentication and privilege changes for guest VM administrators that could precede exploitation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.