VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.
Is CVE-2025-22224 exploited?
Listed in the CISA KEV catalog on 2025-03-04.
Federal remediation due 2025-03-25.
Past that date by 584 days.
EPSS puts exploitation in the next 30 days at 2%.
Public exploit code: none found in monitored sources.
Which products and versions are affected?
VMware · ESXi · >= 8.0, < ESXi80U3d-24585383, >= 8.0, < ESXi80U2d-24585300, >= 7.0, < ESXi70U3s-24585291 (except the fixed hotfixes listed under "Is there a patch?")