CVE-2025-22224CISA KEV
VMware ESXi and Workstation TOCTOU Race Condition Vulnerability
CISA lists this VMware ESXi and Workstation vulnerability as known exploited. The vendor's advisory has the fixed versions.
CISA catalog record
VMware ESXi and Workstation contain a time-of-check time-of-use (TOCTOU) race condition vulnerability that leads to an out-of-bounds write. Successful exploitation enables an attacker with local administrative privileges on a virtual machine to execute code as the virtual machine's VMX process running on the host.
- Product
- ESXi and Workstation
- Added to KEV
- 4 Mar 2025
- Federal remediation due
- 25 Mar 2025
- Known ransomware use
- Not reported