VMware products: heap-overflow (CVE-2025-22224) #shorts

Summary

Hello and welcome to today's cybersecurity podcast. In today's episode, we're discussing the critical vulnerability CVE-2025-22224 that affects VMware products, including ESXi, Workstation, and others. This vulnerability poses a significant threat in the form of a buffer overflow attack, and it's currently being actively exploited in the wild.

Product details

CVE-2025-22224 affects several VMware products. Notably, VMware ESXi versions 7.0 and 8.0 are vulnerable, especially those lower than specific patch levels, such as ESXi80U3d-24585383. Additionally, VMware Workstation versions up to 17.x and VMware Cloud Foundation and Telco Cloud Platform and Infrastructure also report vulnerabilities.

Vulnerability type summary

The primary vulnerability type associated with CVE-2025-22224 is a heap-overflow vulnerability, specifically an out-of-bounds write. This is linked to a TOCTOU (Time-of-Check Time-of-Use) vulnerability within the affected systems.

Details of the vulnerability

This TOCTOU vulnerability permits an attacker with local administrative privileges on a virtual machine to exploit the out-of-bounds write flaw. This can lead to the execution of arbitrary code with elevated privileges inside the virtual machine's VMX process on the host, thereby potentially compromising the host system itself. Broadcom has issued advisories as this vulnerability, alongside others, represents a zero-day threat scenario.

Conclusion

CVE-2025-22224 represents a critical threat to tens of thousands of VMware ESXi servers and their related infrastructure. Any entity using vulnerable versions of VMware products should apply the recommended patches immediately to mitigate this risk. Continuous vigilance and prompt action are crucial as the exploitation of this vulnerability continues to take place in the wild. Thank you for tuning in, and stay safe in the cyber world.

Watch the full video on YouTube: CVE-2025-22224

Remediation and exploitation details

This chain involves the following actors

This following systems are involved

Attack entry point

Remediation actions

Exploitation actions

CVE database technical details

CVE ID

CVE-2025-22224

Description

VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.

Provider

vmware

CWE / problem types

Heap-overflow vulnerability

Affected Software Versions

VMware:ESXi:[{'lessThan': 'ESXi80U3d-24585383', 'status': 'affected', 'version': '8.0', 'versionType': 'custom'}, {'lessThan': 'ESXi80U2d-24585300', 'status': 'affected', 'version': '8.0', 'versionType': 'custom'}, {'lessThan': 'ESXi70U3s-24585291', 'status': 'affected', 'version': '7.0', 'versionType': 'custom'}],VMware:Workstation:[{'lessThan': '17.6.3', 'status': 'affected', 'version': '17.x', 'versionType': 'custom'}],VMware:VMware Cloud Foundation:[{'status': 'affected', 'version': '5.x, 4.5.x'}],VMware:Telco Cloud Platform:[{'status': 'affected', 'version': '5.x, 4.x, 3.x, 2.x'}],VMware:Telco Cloud Infrastructure:[{'status': 'affected', 'version': '3.x, 2.x'}]

Date Published

2025-03-04T11:56:12.317Z

Last Updated

2025-04-03T14:39:46.987Z