CVE-2025-22224—VMware ESXi and Workstation TOCTOU Race Condition Vulnerability

漏洞名称

VMware ESXi and Workstation TOCTOU Race Condition Vulnerability

描述

VMware ESXi and Workstation contain a time-of-check time-of-use (TOCTOU) race condition vulnerability that leads to an out-of-bounds write. Successful exploitation enables an attacker with local administrative privileges on a virtual machine to execute code as the virtual machine's VMX process running on the host.

已知用于勒索软件活动吗？

勒索软件状态：

Unknown

采集行动

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

其他说明

• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390
• https://nvd.nist.gov/vuln/detail/CVE-2025-22224

相关新闻文章

• CISA confirms exploitation of VMware ESXi flaw by ransomware attackersFebruary 5, 2026
• CISA: VMware ESXi flaw now exploited in ransomware attacksFebruary 4, 2026
• CISA says critical VMware RCE flaw now actively exploitedJanuary 26, 2026
• China-Linked Hackers Exploit VMware ESXi Zero-Days to Escape Virtual MachinesJanuary 9, 2026
• VMware ESXi zero-days likely exploited a year before disclosureJanuary 8, 2026

相关 CWE

• CWE-367