dbcve.org
Actively exploited in the wild. This CVE is on the CISA Known Exploited Vulnerabilities list — treat remediation as urgent. Federal remediation due by 25 Mar 2025.
EsxiOperating system · VMware

CVE-2025-22226

MEDIUM · 6.0 CVSS v3.1 Published 2025-03-04
Fix available
A fix is available. Upgrade to 13.6.3 / 17.6.3 or later.
See remediation →
96/100
Remediation priority · Urgent
In the wild Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. A malicious actor with administrative privileges to a virtual machine may be able to exploit this issue to leak memory from the vmx process.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · moderate confidence

VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability in the HGFS (Host-Guest File System) component. The vulnerability is caused by an out-of-bounds read that allows a malicious actor with administrative privileges on a virtual machine to leak memory from the vmx process.

MitigationApply VMware security patches for ESXi, Workstation, and Fusion as provided in the official VMware security advisories. Additionally, limit administrative privileges on virtual machines to trusted personnel only.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
EsxiOperating system
Affected:= 7.0= 8.0
Cloud FoundationApplication
Affected:all versions
FusionApplication
Affected:>= 13.0.0, < 13.6.3
Telco Cloud InfrastructureApplication
Affected:= 2.2= 2.5= 2.7= 3.0
Telco Cloud PlatformApplication
Affected:= 2.0= 2.5= 2.7= 3.0= 4.0= 4.0.1= 5.0
WorkstationApplication
Affected:>= 17.0, < 17.6.3

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify the VMware product and version
    Run 'esxcli system version get' for ESXi, 'vmware -v' for Workstation/Fusion, or check the vSphere/vCloud Director console for Cloud Foundation and Telco products
    Affected if The installed version matches one of the affected versions: ESXi 7.0 or 8.0, Fusion 13.0.0-13.6.2, Workstation 17.0-17.6.2, or any version of Cloud Foundation/Telco Cloud Infrastructure/Telco Cloud Platform listed in the advisory
  2. Verify HGFS is enabled on the virtual machine
    Check VMware Tools configuration: on the VM, run 'vmware-toolbox-cmd config get hgfs' or inspect the .vmx file for 'sharedFolder.enabled' and 'hgfs.transport' parameters
    Affected if HGFS (Host-Guest File System) is enabled, as the vulnerability exists in the HGFS component and only affects environments where shared folders are configured
  3. Confirm the VM has administrative privileges configured
    Review VM configuration settings and guest operating system user privileges; this vulnerability requires an attacker with administrative/root access inside the virtual machine
    Affected if The virtual machine allows users with administrative privileges to execute code, as the advisory specifies this privilege level is required for exploitation

You are affected if you run any of the listed product versions AND have HGFS/shared folders enabled, which allows a privileged attacker inside the VM to trigger the out-of-bounds read in the vmx process memory.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 13.6.3 / 17.6.3 or later
Fixed in 13.6.317.6.3
Interim mitigation

Apply VMware security patches for ESXi, Workstation, and Fusion as provided in the official VMware security advisories. Additionally, limit administrative privileges on virtual machines to trusted personnel only.

Recommended fix High confidence

Workstation: 17.6.3 or later; Fusion: 13.6.3 or later; ESXi: 8.0 U2+ or 7.0 U3+; Cloud Foundation/Telco products: Contact Broadcom for version-specific patches

  1. 1. Identify the affected VMware product and current version in your environment (ESXi, Workstation, or Fusion)
  2. 2. For VMware Workstation: Download and install version 17.6.3 or later from the VMware website or Broadcom support portal
  3. 3. For VMware Fusion: Download and install version 13.6.3 or later from the VMware website or Broadcom support portal
  4. 4. For VMware ESXi: Plan an upgrade to a supported patch version (ESXi 8.0 Update 2 or later, or ESXi 7.0 Update 3 or later) following VMware documentation
  5. 5. For VMware Cloud Foundation, Telco Cloud Infrastructure, or Telco Cloud Platform: Contact Broadcom support for the specific patch or upgrade path for your version
  6. 6. After upgrading, verify the HGFS version corresponds to the patched release
  7. 7. Test that virtual machines function correctly post-upgrade
Caveat Upgrades may require VM downtime and should be tested in a staging environment; ensure VM backups exist before applying updates

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Esxi Exploited in the wild — priority engagement
  • Consultation3.0 h
  • Implementation4.0 h
  • Testing6.0 h
  • Review / QA2.0 h
15.0 hours of engineering $2,580
Get it fixed fast

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $4,128.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2025-22226 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2025-22226 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data