CVE-2025-22224

The vulnerability results from a race condition (TOCTOU) between the moment of resource verification and the moment of its use. An attacker with local administrative privileges within the virtual machine can exploit this time window to cause an out-of-bounds write to memory buffer. This results in the possibility of arbitrary code execution within the VMX process, which runs directly on the host system, not within the isolated VM environment.

An attacker can execute arbitrary code as the VMX process on the physical host, which in practice means a complete breakdown of virtual machine (VM) isolation and potential takeover of the host system and other virtual machines.

Patches available from the vendor must be applied immediately in accordance with Broadcom Security Advisory 25390 (https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390). As a temporary measure, restrict administrative access to virtual machines exclusively to trusted users.

VMware ESXi, VMware Workstation, VMware Cloud Foundation, VMware Telco Cloud Infrastructure — versions indicated in vendor references (Broadcom Security Advisory 25390)

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

VMware ESXi and Workstation contain a time-of-check time-of-use (TOCTOU) race condition vulnerability that leads to an out-of-bounds write. Successful exploitation enables an attacker with local administrative privileges on a virtual machine to execute code as the virtual machine's VMX process running on the host.