CVE-2025-22224

State: Published
Severity: 9.3 Critical
Published: Mar 4, 2025
Updated: Feb 26, 2026
Reserved: Jan 2, 2025

Description

VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.

Scores

CVSS	Score	Vector	Source
3.1	9.3 Critical	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	vmware

Weaknesses

CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

Affected Products

Product	Versions
ESXiVMware	8.0 to before ESXi80U3d-24585383Affected 8.0 to before ESXi80U2d-24585300Affected 7.0 to before ESXi70U3s-24585291Affected
WorkstationVMware	17.x to before 17.6.3Affected
VMware Cloud FoundationVMware	5.x, 4.5.xAffected
Telco Cloud PlatformVMware	5.x, 4.x, 3.x, 2.xAffected
Telco Cloud InfrastructureVMware	3.x, 2.xAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.