Broadcom published an advisory for three flaws in several VMware products that were exploited in the wild as zero-days. Organizations are advised to apply the available patches.

CVE-2025-22224, CVE-2025-22225, CVE-2025-22226: Zero-Day Vulnerabilities in VMware ESXi, Workstation and Fusion Exploited

VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. A malicious actor with administrative privileges to a virtual machine may be able to exploit this issue to leak memory from the vmx process.

Reports indicate these vulnerabilities have been exploited in the wild and could lead to VM escape. Apply available updates immediately.

The version of VMware ESXi installed on the remote host is 7.0 prior to 7.0 Update 3s, 8.0 Update 2 prior to 8.0 Update 2d, or 8.0 Update 3 prior to 8.0 Update 3d. It is, therefore, affected by an information disclosure vulnerability:

  - VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read     in HGFS. A malicious actor with administrative privileges to a virtual machine may be able to exploit this issue to     leak memory from the vmx process. (CVE-2025-22226)


Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of VMware Workstation installed on the remote host is 17.x prior to 17.6.3. It is, therefore, affected by multiple vulnerabilities:

  - VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an     out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this     issue to execute code as the virtual machine's VMX process running on the host. (CVE-2025-22224)     
  - VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read     in HGFS. A malicious actor with administrative privileges to a virtual machine may be able to exploit this issue to     leak memory from the vmx process. (CVE-2025-22226)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of VMware Fusion installed on the remote macOS host is 13.x prior to 13.6.3. It is, therefore, affected by an information disclosure vulnerability:

  - VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read     in HGFS. A malicious actor with administrative privileges to a virtual machine may be able to exploit this issue to     leak memory from the vmx process. (CVE-2025-22226)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
226454	VMware ESXi 7.0 / 8.0 Information Disclosure (CVE-2025-22226)	Nessus	Misc.	high
222493	VMware Workstation 17.x < 17.6.3 Multiple Vulnerabilities (VMSA-2024-0004)	Nessus	General	critical
222492	VMware Fusion 13.x < 13.6.3 HGFS Information Disclosure (VMSA-2025-0004)	Nessus	MacOS X Local Security Checks	high

Detections

Analytics

CVE-2025-22226

medium

Tenable Plugins

high

critical

high