{"id":"CVE-2025-22224","published":"2025-03-04T12:15:33Z","modified":"2026-06-17T08:45:43Z","title":"VMware ESXi and Workstation TOCTOU Race Condition Vulnerability","vendor":"VMware","product":"ESXi and Workstation","tier":"core","eol":null,"description":{"text":"VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.","provenance":"source","from":"NVD"},"summary":{"text":"A TOCTOU (time-of-check to time-of-use) race condition in VMware ESXi and Workstation can lead to an out-of-bounds write. The flaw lies in the handling of these products' virtual machine components. An attacker who already holds local administrative privileges inside a virtual machine can exploit the flaw to execute code as the VMX process on the host, without user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T05:10:05Z"},"cvss":{"score":8.2,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.01561,"percentile":0.75213,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2025-03-04","dueDate":"2025-03-25","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390 ; https://nvd.nist.gov/vuln/detail/CVE-2025-22224","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-03-04","exploitedFirstSeen":"2025-03-04","ransomware":true,"evidence":[{"url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390","date":"2025-03-04"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-03-04"},{"url":"https://blog.talosintelligence.com/patch-it-up-old-vulnerabilities-are-everyones-problems/","date":"2025-03-13"},{"url":"https://blog.qualys.com/vulnerabilities-threat-research/2025/05/08/inside-lockbit-defense-lessons-from-the-leaked-lockbit-negotiations","date":"2025-05-08"},{"url":"https://security.pditechnologies.com/resources/q1-2025-cyber-threat-report/","date":"2025-05-22"},{"url":"https://github.com/vmware/vcf-security-and-compliance-guidelines/tree/main/security-advisories/vmsa-2025-0004","date":"2025-07-15"},{"url":"https://assets.recordedfuture.com/insikt-report-pdfs/2025/cta-2025-0828.pdf","date":"2025-08-28"},{"url":"https://slcyber.io/whitepapers-reports/an-escalation-in-attacks-the-ransomware-landscape-in-h1-2025/","date":"2025-09-25"},{"url":"https://www.huntress.com/blog/esxi-vm-escape-exploit","date":"2026-01-07"},{"url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","date":"2026-01-20"}],"evidenceTotal":11,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-367","name":"Time-of-check Time-of-use (TOCTOU) Race Condition"}],"references":[{"url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-22224","tags":["US Government Resource"]}],"techniques":[{"id":"T1055","name":"Process Injection","tactics":["privilege-escalation","stealth"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Out-of-Bounds (Read and Write)","mappingType":"exploitation_technique","evidence":[],"comment":"By exploiting the TOCTOU vulnerability in VMWare ESXi, Workstation, and Fusion, an attacker with local admin privileges can execute code in the VMX process on the host, in effect, functioning as an escape from the virtual machine to the host system.","confidence":"high"},{"id":"T1611","name":"Escape to Host","tactics":["privilege-escalation"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Out-of-Bounds (Read and Write)","mappingType":"primary_impact","evidence":[],"comment":"By exploiting the TOCTOU vulnerability in VMWare ESXi, Workstation, and Fusion, an attacker with local admin privileges can execute code in the VMX process on the host, in effect, functioning as an escape from the virtual machine to the host system.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-7603","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-7603","exploited":true,"exploitedSince":"2025-03-04","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1055"],"provenance":"source"},{"stage":"primary","techniques":["T1611"],"provenance":"source"}],"timeline":[{"date":"2025-03-04","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22224","provenance":"source"},{"date":"2025-03-04","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390","provenance":"source"},{"date":"2025-03-04","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-03-04","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-7603","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":0},"priority":{"score":68.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 606 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":15.04,"detail":"percentile 0.7521"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.74,"detail":"base score 8.2"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}