CVE-2025-22224
Published: March 4, 2025
Official Description
VMware ESXi and Workstation contain a time-of-check time-of-use (TOCTOU) race condition vulnerability that leads to an out-of-bounds write. Successful exploitation enables an attacker with local administrative privileges on a virtual machine to execute code as the virtual machine's VMX process running on the host.
CISA KEV Advisory
VMware ESXi and Workstation TOCTOU Race Condition Vulnerability
VMware ESXi and Workstation contain a time-of-check time-of-use (TOCTOU) race condition vulnerability that leads to an out-of-bounds write. Successful exploitation enables an attacker with local administrative privileges on a virtual machine to execute code as the virtual machine's VMX process running on the host.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Risk Analysis
VMware ESXi and Workstation are affected by a time-of-check time-of-use (TOCTOU) race condition that leads to an out-of-bounds write. This allows an attacker with local administrative privileges on a virtual machine to execute code on the host. The high EPSS score of 0.59965 and confirmed exploitation make this a severe threat to virtualization environments.
This vulnerability is actively exploited in the wild and is listed in CISA's KEV catalog. Exploitation requires local administrative privileges on a virtual machine.
Apply the latest security patches from VMware for ESXi and Workstation. Implement strong access controls and minimize privileges for virtual machine administrators.
Technical Analysis
CVE-2025-22224 requires local access, meaning attackers must already have a foothold on the target system.
Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
CISA has added CVE-2025-22224 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.
Affected Vendors & Products
Exploit & PoC Resources
All References (2)
Quick Facts
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2025-22224 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
- !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
- !Active exploitation confirmed — treat as P1