CVE-2025-22224
Published 2025-03-04 · Updated 2026-06-17 · Source security@vmware.com
Summary
CVE-2025-22224 is a critical-severity (CVSS 9.3) vulnerability in VMware ESXi and Workstation. CISA added it to the Known Exploited Vulnerabilities catalog on March 4, 2025, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by March 25, 2025. CISA does not currently list it as used in ransomware campaigns. VMware has 26 vulnerabilities in the KEV catalog, 9 of them linked to ransomware.
All 26 known-exploited VMware vulnerabilities →Description
VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: VMware — ESXi and Workstation
Name: VMware ESXi and Workstation TOCTOU Race Condition Vulnerability
Date added: 2025-03-04 · Due: 2025-03-25
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.