VMware ESXi and Workstation TOCTOU Race Condition Vulnerability
VMware — ESXi and Workstation
- Added to KEV catalog
- 4 March 2025
- Federal remediation due date
- 25 March 2025
- Weakness classification (CWE)
- CWE-367
CISA Description
VMware ESXi and Workstation contain a time-of-check time-of-use (TOCTOU) race condition vulnerability that leads to an out-of-bounds write. Successful exploitation enables an attacker with local administrative privileges on a virtual machine to execute code as the virtual machine's VMX process running on the host.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390 ; https://nvd.nist.gov/vuln/detail/CVE-2025-22224
More VMware Vulnerabilities
VMware ESXi Arbitrary Write Vulnerability
VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability
VMware vCenter Server Heap-Based Buffer Overflow Vulnerability
VMware vCenter Server Privilege Escalation Vulnerability
VMware ESXi Authentication Bypass Vulnerability
Is this vulnerability present in your environment?
CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.
Explore VAPT Services