CVE-2025-22225: VMware ESXi Arbitrary Write Vulnerability

Description

VMware ESXi contains an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may trigger an arbitrary kernel write leading to an escape of the sandbox.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack vector

Local

Complexity

Low

Privileges

High

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)1.0% · higher than 63% of CVEs

Exploited in the wildYes

CISA KEVListed Mar 4, 2025

Federal remediation dueMar 25, 2025

Ransomware campaign useKnown

Affected products

Which versions

ES

ESXi · VMware

8.0 before ESXi80U3d-24585383; 8.0 before ESXi80U2d-24585300; 7.0 before ESXi70U3s-24585291 · source: vendor, NVD, KEV

VC

VMware Cloud Foundation ·

5.x, 4.5.x · source: vendor

VT

VMware Telco Cloud Infrastructure ·

3.x, 2.x · source: vendor

VT

VMware Telco Cloud Platform ·

5.x, 4.x, 3.x, 2.x · source: vendor

CF

Cloud Foundation · Vmware

All versions, or not specified · source: NVD

TC

Telco Cloud Infrastructure · Vmware

2.2; 2.5; 2.7; 3.0 · source: NVD

TC

Telco Cloud Platform · Vmware

2.0; 2.5; 2.7; 3.0; 4.0; 4.0.1; +1 more · source: NVD