VMware Security Alert: Critical Patches for ESXi, Workstation, and Fusion Vulnerabilities

• Facebook
• Twitter

VMware Security Alert: Critical Patches for ESXi, Workstation, and Fusion Vulnerabilities

• Why Enterprise RAID Rebuilding Succeeds Where Consumer Arrays Fail?
• Linus Torvalds Rejects MMC Subsystem Updates for Linux 7.0: “Complete Garbage”
• The Man Who Maintained Sudo for 30 Years Now Struggles to Fund the Work That Powers Millions of Servers
• How Close Are Quantum Computers to Breaking RSA-2048?
• Why Windows 10 Users Are Flocking to Zorin OS 18 Instead of Linux Mint?
• How to Prevent Ransomware Infection Risks?
• What is the best alternative to Microsoft Office?

VMware Security Alert: Critical Patches for ESXi, Workstation, and Fusion Vulnerabilities

VMware Urgent Security Advisory: VMSA-2025-0004 Addresses Actively Exploited Vulnerabilities in ESXi, Workstation, and Fusion

VMware has released updates for ESXi, Workstation, and Fusion to address multiple vulnerabilities (CVE-2025-22224, CVE-2025-22225, CVE-2025-22226). Immediate patching is required. For details on previous high-risk vulnerabilities in VMware vCenter (CVE-2024-38812 and CVE-2024-38813) and their fixes, refer to earlier advisories.

Broadcom’s VMware team has confirmed that CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226 are being actively exploited in the wild. It is critical to apply the necessary patches immediately.

Affected Products:

• VMware ESXi

• VMware Workstation Pro / Player (Workstation)

• VMware Fusion

• VMware Cloud Foundation

• VMware Telco Cloud Platform

Security Advisory KB

Vulnerability Details

1. VMCI Heap Overflow Vulnerability (CVE-2025-22224)

Description: A Time-of-Check Time-of-Use (TOCTOU) vulnerability in VMware ESXi and Workstation may lead to an out-of-bounds write. VMware has classified this as a critical issue, with a maximum CVSSv3 base score of 9.3.

Attack Vector: A malicious actor with local administrative privileges on a virtual machine could exploit this vulnerability to execute code within the VMX process on the host.

Solution: Apply the patch specified in the “Fixed Versions” column of the “Response Matrix.”

Workaround: None.

Note: Broadcom’s VMware team has confirmed that this vulnerability is being actively exploited in the wild.

2. VMware ESXi Arbitrary Write Vulnerability (CVE-2025-22225)

Description: VMware ESXi contains an arbitrary write vulnerability. This has been assessed as a high-severity issue, with a maximum CVSSv3 base score of 8.2.

Attack Vector: An attacker with access to the VMX process could trigger an arbitrary kernel write, potentially leading to sandbox escape.

Solution: Apply the relevant patch listed in the “Fixed Versions” column of the “Response Matrix.”

Workaround: None.

Note: Broadcom’s VMware team has confirmed active exploitation of this vulnerability in the wild.

3. HGFS Information Disclosure Vulnerability (CVE-2025-22226)

Description: VMware ESXi, Workstation, and Fusion contain an out-of-bounds read vulnerability in HGFS, leading to potential information disclosure. VMware has classified this issue as high severity, with a maximum CVSSv3 base score of 7.1.

Attack Vector: An attacker with administrative privileges on a virtual machine could exploit this issue to leak memory from the VMX process.

Solution: Apply the patch specified in the “Fixed Versions” column of the “Response Matrix.”

Workaround: None.

Note: Broadcom’s VMware team has confirmed that this vulnerability is being actively exploited in the wild.

Affected Products and Fixed Versions

Download and Documentation Links

• VMware ESXi 8.0 ESXi80U3d-24585383: Download & Docs

• VMware ESXi 8.0 ESXi80U2d-24585300: Download & Docs

• VMware ESXi 7.0 ESXi70U3s-24585291: Download & Docs

• VMware Workstation 17.6.3: Windows | Linux

• VMware Fusion 13.6.3: Download & Docs

• VMware Cloud Foundation 5.x, 4.5.x: KB88287

• Telco Cloud Platform 5.x, 4.x, 3.x: Release Notes

For more details and downloads, visit Broadcom’s official site.

VMware Security Alert: Critical Patches for ESXi, Workstation, and Fusion Vulnerabilities

Windows Software Alternatives in Linux

Disclaimer of pbxscience.com