7.1
High
CVE-2025-22226 VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability
Active exploitation observed
· CISA KEV catalogue
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Ransomware campaigns
Not observed so far
Weakness
CWE-125
Description
VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. A malicious actor with administrative privileges to a virtual machine may be able to exploit this issue to leak memory from the vmx process.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| ESXi 8.0 | 8.0 → latest | No fix stated |
| ESXi 7.0 | 7.0 → latest | No fix stated |
| VMware Workstation 17 | 17.x → < 17.6.3 | 17.6.3 |
| VMware Fusion 13 | 13.x → < 13.6.3 | 13.6.3 |
| VMware Cloud Foundation | Versions not published | |
| VMware Telco Cloud Platform | Versions not published | |
| VMware Telco Cloud Infrastructure | Versions not published |