Three Zero-Day Vulnerabilities Discovered in VMware Products

Key Takeaways

Three zero-day vulnerabilities have been discovered in VMware products, tracked as CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226.
Nearly all supported and unsupported VMware products are impacted, including VMware ESXi, VMware Workstation Pro / Player (Workstation), VMware Fusion, VMware Cloud Foundation, and VMware Telco Cloud Platform.
Chaining these 3 vulnerabilities together allows an attacker to escape or “break out” of a “child” Virtual Machine (VM), gain access to the “parent” ESXi Hypervisor, and potentially access any other accessible VM as well as gain access to the management network of the exposed VMware cluster.
We recommend upgrading to “fixed versions” indicated in the VMware by Broadcom matrix immediately.

Background

Three zero-day vulnerabilities, tracked as CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226, have been discovered across nearly every supported and unsupported VMware product. These vulnerabilities have CVSSv3.1 scores of 9.3 (Critical), 8.2 (Important), and 7.1 (Important), respectively. Impacted products include VMware ESXi, VMware Workstation Pro / Player (Workstation), VMware Fusion, VMware Cloud Foundation, and VMware Telco Cloud Platform. For a full breakdown of affected versions of each product, review the VMware by Broadcom matrix here. According to VMware, these 3 vulnerabilities have been identified as being actively exploited “in the wild”.

Chaining these 3 vulnerabilities together allows an attacker to escape or “break out” of a “child” Virtual Machine (VM), gain access to the “parent” ESXi Hypervisor, and potentially access any other accessible VM as well as gain access to the management network of the exposed VMware cluster.

What Does This Mean?

Imagine a high-security office building where each employee (or system) works in their own locked office (a VM) and security cameras (EDR) monitor activity inside those offices. If a threat actor found their way into a monitored office, the security cameras might catch them moving around or using tools (scripts) in the office, but if they leverage these 3 vulnerabilities together, then they can move instantly and directly from the office to the building’s main security control room (the Hypervisor) which is not monitored by security cameras.

VM Escape attacks like this are often the most sought after capabilities for Nation State and Organized/eCrime groups. These attacks are desirable because they avoid privilege escalation attempts and can significantly reduce traditional “noise” from an Intrusion Path.

VMware products and versions that are end-of-life have not been included in the Broadcom advisory and will not have security patches released. As such, end-of-life versions of impacted products may also have these vulnerabilities. Cybereason recommends that related products be upgraded to supported versions that are eligible to receive critical security updates.

Vulnerability Details:

CVE-2025-22224

CVSS Score: 9.3 (Critical)
This vulnerability is known as a Time-of-Check Time-of-Use (TOCTOU) and could allow for an out of bounds re-write
An unauthorized attacker with local administrative privileges on a virtual machine could exploit this vulnerability to execute code as the virtual machine's VMX process running on the host.

CVE-2025-22225

CVSS Score: 8.2 (Important)
An unauthenticated attacker with privileges within the VMX process could trigger arbitrary kernel write, which could lead to an escape of the sandbox.

CVE-2025-22226

CVSS Score: 7.3 (Important)
This vulnerability is an information disclosure vulnerability, due to an out-of-bounds read in HGFS
An unauthenticated attacker with admin privileges to a VM may be able to exploit this vulnerability to leak memory from the vmx process.

Guidance

In hosted VMware cloud environments, where multiple customers share the same physical infrastructure, breaking out of a single virtual machine and into the Hypervisor eliminates the separation between tenants, potentially allowing access to the administrative network, and management or access to additional virtual machines managed by the hypervisor.

By the time an event or incident alert may have been generated, the attacker will have already “broken out” of an impacted VM and gained access to the Hypervisor. Common Security Operations Center (SOC) responses like hash banning or deleting a detected script will not contain the threat in this incident. Further investigation and containment is absolutely necessary.

In addition, Cybereason recommends conducting analysis of historical MDR logs for evidence of this attack prior to the CVE disclosures and the organization’s patching.

Hosted VMware cloud environments should prioritize patching. This exploit chain requires local administrative privileges and as such, end-clients with threat actors within their hosts, or potential threat actors posing as clients provisioning their own VMs may provide increased risk exposure.