Security Week

Broadcom Patches 3 VMware Zero-Days Exploited in the Wild

Eduard Kovacs March 4, 2025

Broadcom released a security alert on Tuesday morning to warn VMware customers about three zero-days that have been exploited in the wild.

The vulnerabilities, tracked as CVE-2025-22224, CVE-2025-22225 and CVE-2025-22226, affect VMware ESXi, Workstation, and Fusion. Patches have been released for each impacted product.

CVE-2025-22224 has been described as a critical VMCI heap overflow vulnerability affecting VMware ESXi and Workstation that allows an attacker with local admin privileges on a virtual machine (VM) to “execute code as the virtual machine’s VMX process running on the host”.

CVE-2025-22225, which affects VMware ESXi, is a high-severity arbitrary file write issue that allows an attacker with privileges within the VMX process to “trigger an arbitrary kernel write leading to an escape of the sandbox”.

CVE-2025-22226 affects VMware ESXi, Workstation and Fusion. It’s a high-severity information disclosure flaw caused by an out-of-bounds read bug in the HGFS component, which allows an attacker who has administrative privileges to a VM to leak memory from the VMX process.

At the time of writing there does not appear to be any public information describing attacks involving these vulnerabilities.

Broadcom pointed out that workarounds are not available, but exploitation of the vulnerabilities requires elevated privileges, which indicates that they have likely been exploited in more targeted attacks after threat actors have gained initial access to the targeted entity’s systems.

This theory is reinforced by the fact that — in a supplemental FAQ document — Broadcom clarified that the vulnerabilities can lead to a VM escape.

Advertisement. Scroll to continue reading.

“This is a situation where an attacker who has already compromised a virtual machine’s guest OS and gained privileged access (administrator or root) could move into the hypervisor itself,” the vendor explained.

Broadcom has credited Microsoft Threat Intelligence Center for reporting these vulnerabilities. SecurityWeek has reached out to Microsoft for additional information on the attacks and will update this article if the company responds.

It’s not uncommon for threat actors to exploit VMware product vulnerabilities in their attacks. The Known Exploited Vulnerabilities (KEV) catalog maintained by the cybersecurity agency CISA currently includes 26 VMware flaws. The KEV list is known to be incomplete so the actual number could be even higher.