Log In
Request Demo Start 30-Day Trial
Back to CVEs
CVE CVE

CVE-2025-22225

CISA Known Exploited Vulnerability (KEV)

VMware ESXi Arbitrary Write Vulnerability

March 4, 2025

March 25, 2025

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Description

VMware ESXi contains an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may trigger an arbitrary kernel write leading to an escape of the sandbox.

References

Weakness Enumeration

CWE-ID CWE Name

CWE-123 		Write-what-where Condition

CWE-787 		Out-of-bounds Write

Known Affected Software Configurations


cpe:2.3:a:vmware:telco_cloud_infrastructure:2.2:*:*:*:*:*:*:*

cpe:2.3:a:vmware:telco_cloud_infrastructure:2.5:*:*:*:*:*:*:*

cpe:2.3:a:vmware:telco_cloud_infrastructure:2.7:*:*:*:*:*:*:*

cpe:2.3:a:vmware:telco_cloud_infrastructure:3.0:*:*:*:*:*:*:*

cpe:2.3:a:vmware:telco_cloud_platform:2.0:*:*:*:*:*:*:*

cpe:2.3:a:vmware:telco_cloud_platform:2.5:*:*:*:*:*:*:*

cpe:2.3:a:vmware:telco_cloud_platform:2.7:*:*:*:*:*:*:*

cpe:2.3:a:vmware:telco_cloud_platform:3.0:*:*:*:*:*:*:*

cpe:2.3:a:vmware:telco_cloud_platform:4.0.1:*:*:*:*:*:*:*

cpe:2.3:a:vmware:telco_cloud_platform:4.0:*:*:*:*:*:*:*

cpe:2.3:a:vmware:telco_cloud_platform:5.0:*:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:7.0:update_3i:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:7.0:update_3j:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:7.0:update_3k:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:7.0:update_3l:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:7.0:update_3m:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:7.0:update_3n:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:7.0:update_3o:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:7.0:update_3p:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:7.0:update_3q:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:7.0:update_3r:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:8.0:update_3b:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:8.0:update_3c:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:8.0:a:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:8.0:b:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:8.0:c:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:8.0:update_1:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:8.0:update_1a:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:8.0:update_1c:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:8.0:update_1d:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:8.0:update_2:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:8.0:update_2b:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:8.0:update_2c:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:8.0:update_3:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:7.0:update_3g:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:8.0:-:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:7.0:update_3f:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:7.0:update_1e:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:7.0:update_2e:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:7.0:update_3e:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:7.0:update_3c:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:7.0:update_3d:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:7.0:update_3:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:7.0:update_1c:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:7.0:update_1d:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:7.0:update_2:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:7.0:update_2a:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:7.0:update_2c:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:7.0:update_2d:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:7.0:-:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:7.0:beta:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:7.0:update_1:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:7.0:update_1a:*:*:*:*:*:*

cpe:2.3:o:vmware:esxi:7.0:update_1b:*:*:*:*:*:*

cpe:2.3:a:vmware:cloud_foundation:-:*:*:*:*:*:*:*

Details

Source:
NVD
Published:
Updated:

Risk information

CVSS v3

Base score:
8.2
Severity:

HIGH

Vector:
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CVSS v2

Not defined