← Back to browse · API

CVE-2025-22224

Severity
CRITICAL
CVSS
9.3
EPSS
0.01561
Risk score
62.75
CISA KEV
Yes
PoC
No
Published
2025-03-04
Modified
2026-02-26
First seen
2026-08-07
Aliases
EUVD-2025-7603, GHSA-J652-46FV-W96G
Products
VMware:ESXi and Workstation, VMware:Telco Cloud Infrastructure 3.x, 2.x, VMware:Telco Cloud Platform 5.x, 4.x, 3.x, 2.x, VMware:VMware Cloud Foundation 5.x, 4.5.x, VMware:Workstation 17.x <17.6.3, n/a:ESXi 7.0 <ESXi70U3s-24585291, n/a:ESXi 8.0 <ESXi80U2d-24585300, n/a:ESXi 8.0 <ESXi80U3d-24585383
Sources
euvd EUVD-2025-7603
cisa.gov CVE-2025-22224

Description

VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.

References