CVE-2025-22226: VMware ESXi, Workstation and Fusion HGFS out-of-bounds read leaks vmx memory

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is a medium-severity local information disclosure, but its presence in CISA KEV with a near-term remediation deadline signals confirmed exploitation and warrants prompt patching.

What it is

VMware ESXi, Workstation, Fusion and related cloud products contain an out-of-bounds read in the HGFS (Host Guest File System) component. A malicious actor with administrative privileges inside a virtual machine can trigger the flaw to leak memory from the vmx process. Because the leaked memory comes from the hypervisor-side VM process, it can expose sensitive host or guest data that should not be reachable from the guest.

Impact

An attacker with administrative rights in a guest VM gains read access to memory belonging to the vmx process, potentially exposing sensitive data such as credentials, keys or other VM state. The flaw is read-only, so it does not by itself give code execution or data modification.

Attack surface

The vulnerability is local to the guest: it is reached from within a virtual machine through HGFS, requiring high privileges (administrative access in the guest) and no user interaction. The CVSS vector AV:L/PR:H/UI:N confirms a local, privileged attack path with scope change.

Exploitation

CVE-2025-22226 was added to CISA KEV on 2025-03-04 with a remediation due date of 2025-03-25, indicating known exploitation in the wild. EPSS is low (0.01735, ~76th percentile), and no ransomware campaign use is documented.

What to do

• Apply the vendor patches from the Broadcom/VMware security advisory for ESXi, Workstation, Fusion, Cloud Foundation and Telco Cloud products.
• If patching is not immediately possible, follow the vendor mitigations or discontinue use of the affected product per CISA BOD 22-01 guidance.
• Restrict administrative access inside guest VMs and limit who can operate privileged guests on shared hypervisors.
• Disable or restrict HGFS/shared folders where they are not required, especially on Workstation and Fusion hosts.
• Monitor for and isolate any guest VM exhibiting unexpected memory disclosure behavior until patched.

Detection

• Monitor hypervisor and vmx process logs for crashes, aborts or unusual memory-related errors on ESXi hosts.
• Audit guest VMs for unexpected HGFS or shared-folder usage and for non-standard administrative activity inside guests.
• Track patch compliance for ESXi, Workstation, Fusion and Cloud Foundation against the vendor advisory.
• Correlate KEV-listed exploitation indicators with host and guest telemetry to identify attempted abuse.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.