VMware · ESXi
CVE-2025-22225
VMware ESXi Arbitrary Write Vulnerability
What it is
VMware ESXi contains an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may trigger an arbitrary kernel write leading to an escape of the sandbox.
CISA: VMware ESXi contains an arbitrary write vulnerability. Successful exploitation allows an attacker with privileges within the VMX process to trigger an arbitrary kernel write leading to an escape of the sandbox.
What to do
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: March 25, 2025
More exploited flaws from VMware
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Jul 30, 2024 | Authentication Bypass | ESXi | Medium 6.8 | 27% |
| Nov 3, 2021 | OpenSLP Use-After-Free | ESXi | Critical 9.8 | 83% |
| Mar 4, 2025 | TOCTOU Race Condition | ESXi and Workstation | Critical 9.3 | 1.6% |
| Mar 4, 2025 | Information Disclosure | ESXi, Workstation, and Fusion | High 7.1 | 1.6% |
| Nov 20, 2024 | Heap-Based Buffer Overflow | vCenter Server | Critical 9.8 | 55% |
| Nov 20, 2024 | Privilege Escalation | vCenter Server | High 7.5 | 17% |
| Jul 17, 2024 | Incorrect Default File Permissions Vulnerability | vCenter Server | Medium 6.5 | 13% |
| Jan 22, 2024 | Out-of-Bounds Write | vCenter Server | Critical 9.8 | 99.2% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.