CVE-2025-22226

What it actually does

VMware ESXi, Workstation, and Fusion contain an out-of-bounds read vulnerability in HGFS, the host-guest file sharing component used by VMware shared folders. An attacker who already has administrative privileges inside a guest virtual machine can send crafted HGFS interactions that cause the host-side vmx process to read memory outside the intended buffer and disclose portions of that process memory. The flaw is an information disclosure issue: it does not by itself provide code execution or a full VM escape, but leaked vmx memory may expose sensitive runtime data, assist exploitation of other VMware vulnerabilities, or weaken mitigations such as address-space layout randomization when chained with additional flaws.

Why it matters to the business

Successful exploitation can expose sensitive memory from the virtualization process that brokers a virtual machine, increasing the risk of credential exposure, host/guest isolation weakening, and chained compromise of virtualization infrastructure. Because this vulnerability is listed in CISA KEV and marked as actively exploited in the wild, organizations should treat it as urgent even though the standalone CVSS score is moderate and the EPSS score is relatively low. The CISA remediation due date was 2025-03-25, so unpatched internet-facing, user-accessible, or high-trust virtualization platforms should be considered overdue for remediation.

How an attack unfolds

An attacker first obtains administrative control of a guest virtual machine running on a vulnerable VMware ESXi, Workstation, or Fusion host. If HGFS/shared folders are available to that VM, the attacker uses guest-level administrative access to interact with the HGFS interface and submit specially crafted requests that trigger an out-of-bounds read in the host-side vmx process. The vulnerable vmx process returns or exposes memory contents beyond the intended buffer boundary. The attacker can then analyze the leaked memory for sensitive values, process layout information, tokens, configuration material, or data useful for bypassing exploit mitigations. In real intrusions, this type of bug is most concerning when chained with other VMware vulnerabilities to progress from guest compromise toward host compromise or broader virtualization-layer access.

How to fix it

Apply the vendor-provided VMware fixes for all affected ESXi, Workstation, and Fusion installations. Where exact fixed versions are not available from asset data, verify against the current Broadcom/VMware security advisory for CVE-2025-22226 and upgrade to the latest supported build for each affected product line. As risk-reduction until patching is complete, disable VMware shared folders/HGFS where not strictly required, remove unnecessary guest administrative privileges, restrict who can administer guest VMs, avoid running untrusted workloads on vulnerable hosts, and prioritize remediation for systems hosting high-value workloads or VMs controlled by less-trusted users. Because this issue is in CISA KEV and has been exploited in the wild, compensating controls should be temporary rather than a substitute for patching.

How to confirm the fix worked

Confirm exposure by inventorying VMware ESXi, Workstation, and Fusion versions and comparing them with the fixed versions in the applicable VMware/Broadcom advisory. Validate that all vulnerable hosts and desktop hypervisors have been upgraded or otherwise remediated, and confirm that no vulnerable build remains in use. Check VM configuration for shared folders/HGFS and verify it is disabled where not required. For ESXi, validate host build numbers through vSphere Client, ESXCLI, PowerCLI, or centralized lifecycle management tooling. For Workstation and Fusion, validate installed application versions on endpoints. After patching, retest that HGFS/shared-folder functionality is either disabled or operates only on fixed builds, and review change records to ensure all affected systems were rebooted or services restarted as required by the vendor update process.

Typical attack path

1. Gain administrative privileges inside a guest virtual machine hosted by vulnerable VMware ESXi, Workstation, or Fusion.
2. Confirm that VMware shared folders/HGFS functionality is present or reachable from the guest.
3. Send crafted HGFS requests from the guest to the host-side vmx process.
4. Trigger the out-of-bounds read condition and collect leaked vmx process memory.
5. Analyze leaked memory for sensitive data, process layout details, credentials, or exploit primitives.
6. Optionally chain the disclosure with another vulnerability to attempt VM escape, host compromise, or lateral movement through virtualization management infrastructure.

How to detect it

There are no widely reliable public, CVE-specific indicators that conclusively prove exploitation of this out-of-bounds read. Detection should focus on suspicious preconditions and side effects: guest VMs where an untrusted user had administrative access, enabled HGFS/shared folders, unusual or repeated shared-folder activity, vmx process instability, vmware-vmx crashes, core dumps, abnormal hostd/vmkernel/vmware.log events, and exploitation activity occurring after public disclosure on 2025-03-04. Review ESXi logs such as /var/log/hostd.log, /var/log/vmkernel.log, /var/log/vobd.log, per-VM vmware.log files, crash/core dump locations, and centralized hypervisor management logs. For Workstation and Fusion, review per-VM vmware.log files, application crash logs, OS crash reporting artifacts, and endpoint telemetry for unusual vmware-vmx behavior. Correlate suspicious HGFS activity with guest administrative logons, recent privilege escalation inside the guest, unusual file-sharing configuration changes, and any subsequent attempts to exploit additional VMware vulnerabilities. Because exploitation may only leak memory without crashing, absence of logs does not prove non-exploitation.

What your security team should do

• Treat this as a high-priority remediation item because it is in CISA KEV, has active exploitation reported, and the KEV due date of 2025-03-25 has passed.
• Inventory all VMware ESXi, Workstation, and Fusion deployments, including developer workstations, lab systems, jump hosts, and unmanaged virtualization endpoints.
• Patch or upgrade vulnerable products to the current vendor-fixed builds; prioritize ESXi hosts and systems running untrusted or user-administered guest VMs.
• Disable HGFS/shared folders wherever they are not business-critical, especially on VMs used by developers, contractors, malware analysis teams, or other high-risk users.
• Review which users have administrative privileges inside guest VMs and reduce unnecessary guest admin access.
• Hunt for suspicious guest-to-host activity, abnormal vmx process crashes, HGFS errors, and exploitation attempts around and after the publication date of 2025-03-04.
• Assess whether any vulnerable VMware systems also lack fixes for related VMware vulnerabilities that could be chained with this information disclosure flaw.
• Document KEV compliance status and retain evidence of remediation, version validation, and compensating controls.