CVE-2025-22225KEV Β· OVERDUECWE-123CWE-787

VMware ESXi Arbitrary Write Vulnerability

High Β· published March 4, 2025

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.2. It is confirmed in active exploitation. It sits in the 63.0th percentile for exploit probability.

578
days past CISA
deadline
CVSS v3.1
8.2
EPSS
1%
Percentile
63.0
In the wild
Confirmed
What it is

🚨 A malicious actor can trigger an arbitrary kernel write with just the right privileges! This vulnerability in VMware ESXi is a gateway to escaping the sandbox, and it's being actively exploited. πŸ”₯ Think of the virtual machine as a high-security hotel room with strict access controls. If someone can sneak in with a master key, they could waltz out to the hallway and access restricted areas, potentially stealing everything in sight! The consequences could be absolutely devastating. An attacker with privileges inside the VMX process could not only manipulate the virtual environment but also escape to the host system, leading to unauthorized access and data breaches. Imagine a thief gaining access to a bank vault after just getting into the lobby!

Put simply

Think of the virtual machine as a high-security hotel room with strict access controls. If someone can sneak in with a master key, they could waltz out to the hallway and access restricted areas, potentially stealing everything in sight! This arbitrary write vulnerability allows privileged users within the VMX process to execute kernel-level commands, facilitating a sandbox escape that can lead to full system compromise.

What to do

The consequences could be absolutely devastating. An attacker with privileges inside the VMX process could not only manipulate the virtual environment but also escape to the host system, leading to unauthorized access and data breaches. Imagine a thief gaining access to a bank vault after just getting into the lobby! Update VMware ESXi immediately to the latest version to patch this vulnerability. Regularly audit your VMs to ensure only trusted actors have access, and consider implementing additional security layers, such as monitoring tools. Don't waitβ€”this is critical! You've got this! Follow these steps, and soon your systems will be back to being secure fortresses. πŸ›‘οΈ

The record
Technical detail
CVSS v3.1
8.2 Β· HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01016 Β· 63.0th percentile
Weaknesses
CWE-123 Β· Write-what-where Condition; CWE-787 Β· Out-of-bounds Write
Published
2025-03-04T17:15Z
KEV added
2025-03-04 Β· due 2025-03-25
Affected products (55)
ProductVersionsFixed in
vmware/esxiall versionsβ€”
vmware/esxiall versionsβ€”
vmware/esxiall versionsβ€”
vmware/esxiall versionsβ€”
vmware/esxiall versionsβ€”
vmware/esxiall versionsβ€”
vmware/esxiall versionsβ€”
vmware/esxiall versionsβ€”
vmware/esxiall versionsβ€”
vmware/esxiall versionsβ€”
vmware/esxiall versionsβ€”
vmware/esxiall versionsβ€”
vmware/esxiall versionsβ€”
vmware/esxiall versionsβ€”
vmware/esxiall versionsβ€”
vmware/esxiall versionsβ€”
vmware/esxiall versionsβ€”
vmware/esxiall versionsβ€”
vmware/esxiall versionsβ€”
vmware/esxiall versionsβ€”
vmware/esxiall versionsβ€”
vmware/esxiall versionsβ€”
vmware/esxiall versionsβ€”
vmware/esxiall versionsβ€”
vmware/esxiall versionsβ€”
vmware/esxiall versionsβ€”
vmware/esxiall versionsβ€”
vmware/esxiall versionsβ€”
vmware/esxiall versionsβ€”
vmware/esxiall versionsβ€”
vmware/esxiall versionsβ€”
vmware/esxiall versionsβ€”
vmware/esxiall versionsβ€”
vmware/esxiall versionsβ€”
vmware/esxiall versionsβ€”
vmware/esxiall versionsβ€”
vmware/esxiall versionsβ€”
vmware/esxiall versionsβ€”
vmware/esxiall versionsβ€”
vmware/esxiall versionsβ€”
vmware/esxiall versionsβ€”
vmware/esxiall versionsβ€”
vmware/esxiall versionsβ€”
vmware/cloud_foundationall versionsβ€”
vmware/telco_cloud_infrastructureall versionsβ€”
vmware/telco_cloud_infrastructureall versionsβ€”
vmware/telco_cloud_infrastructureall versionsβ€”
vmware/telco_cloud_infrastructureall versionsβ€”
vmware/telco_cloud_platformall versionsβ€”
vmware/telco_cloud_platformall versionsβ€”
vmware/telco_cloud_platformall versionsβ€”
vmware/telco_cloud_platformall versionsβ€”
vmware/telco_cloud_platformall versionsβ€”
vmware/telco_cloud_platformall versionsβ€”
vmware/telco_cloud_platformall versionsβ€”
References (2)
EPSS history
Timeline
  • 04 MAR 11:56Z
    VMware ESXi contains an arbitrary writeΒ vulnerability
    cvelistv5
  • 04 MAR 00:00Z
    Added to CISA KEV β€” remediate by Mar 25
    kev