CVE DatabaseCVE-2025-22226

Updated 2026-06-17한국어 권고문 →

CVE-2025-222266.0/MEDIUMCISA KEVCWE-125CWE-125

VMware ESXi, Workstation, Fusion HGFS Out-of-Bounds Read Information Disclosure (CVE-2025-22226) Technical Advisory

⚡ Jump to Patch

Affected Vendors

vmware

Affected Components

esxi, workstation, fusion

Published Date

2025-03-04

CVSS v3.1

6.0

MEDIUM

EPSS (30d)

1.6%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

VMware ESXi, Workstation, and Fusion environments utilizing the Host-Guest File System (HGFS) for file sharing.

Impact

A malicious actor with local administrative privileges on a guest VM can read out-of-bounds memory from the host's vmx process, potentially bypassing ASLR to facilitate hypervisor escape.

Mitigation

Apply the official security patches provided by Broadcom, or disable the HGFS (Shared Folders) feature in the virtual machine configuration as a temporary workaround.

Affected Products & Version Scope

VMware ESXi, Workstation, and Fusion versions where HGFS (Shared Folders) is enabled.

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Apply the latest security updates from Broadcom. For ESXi hosts, you can perform the update via the ESXi Command Line Interface (CLI):

bash

# Place the ESXi host into maintenance mode
esxcli system maintenanceMode set --enable true

# Install the patch using the offline bundle downloaded from Broadcom Support
esxcli software profile update -d /vmfs/volumes/datastore1/patches/ESXi-patch-bundle.zip -p ESXi-profile-name

# Reboot the host and exit maintenance mode
reboot
esxcli system maintenanceMode set --enable false

2. Temporary Workaround & Hardening Configuration

If patching cannot be applied immediately, disable the HGFS / Shared Folders feature in the .vmx configuration file of each virtual machine to mitigate the risk.

bash

# Power off the virtual machine before editing the configuration
# Edit the .vmx file of the target VM
vi /vmfs/volumes/datastore1/VM_Name/VM_Name.vmx

# Append or modify the following parameters to disable shared folders
sharedFolder.maxNum = '0'
sharedFolder0.present = 'FALSE'

3. Log Audit & IoC Verification Commands

Run the following script on your ESXi host to identify virtual machines that have HGFS/Shared Folders configured:

bash

# Scan all VM configuration files for active HGFS/Shared Folder settings
find /vmfs/volumes/ -name '*.vmx' | while read -r vmx_file; do
  if grep -qi 'sharedFolder' "$vmx_file"; then
    echo "[ALERT] HGFS configuration found in: $vmx_file"
    grep -i 'sharedFolder' "$vmx_file"
  fi
done

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

SentinelOne Singularity AI EDR

Due to active exploitation in the wild, immediately disable HGFS shared folders or apply the official Broadcom security patches to all VMware hosts.

Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot

Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.

100% MITRE ATT&CK Detection · 1-Click Rollback

See Autonomous Endpoint Protection in Action

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2025-22226) is an out-of-bounds read (CWE-125) vulnerability within the Host-Guest File System (HGFS) component of VMware virtualization products. The root cause lies in insufficient input validation of HGFS request packets sent from the guest OS to the host. The hypervisor fails to properly verify the boundaries of the requested buffer size, allowing access to memory outside the allocated space.

2. Exploitation Mechanics & Attack Scenario

An attacker who has already obtained administrative privileges (PR:H) within a guest virtual machine can construct and send malicious HGFS requests to the host hypervisor. When the vmx process on the host processes this request, it reads adjacent memory locations beyond the intended buffer and returns the data to the guest. This leaked memory can contain sensitive pointers, which can be used to defeat Address Space Layout Randomization (ASLR) and orchestrate a full hypervisor escape when chained with other write vulnerabilities. This vulnerability is actively exploited in the wild and is listed in the CISA KEV catalog.

3. Infrastructure & Business Impact

While this vulnerability does not directly allow arbitrary code execution on its own, the disclosure of vmx process memory is a critical stepping stone for hypervisor escape. Successful exploitation compromises the isolation boundary between the guest and the host, threatening the confidentiality and integrity of all other virtual machines running on the same physical host.

Official Vendor Advisories & References

NVD Original English Description

VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. A malicious actor with administrative privileges to a virtual machine may be able to exploit this issue to leak memory from the vmx process.

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390

Source: security@vmware.com · Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-22226

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

Frequently Asked SecOps Questions (CVE-2025-22226)

FAQ

Q1. How critical is CVE-2025-22226 and is it actively exploited in the wild?

CVE-2025-22226 is rated CVSS 6.0 (MEDIUM) with a 30-day EPSS exploitation probability of 1.6%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2025-22226?

Primary impacted vendors include vmware across esxi, workstation, fusion. Scope summary: VMware ESXi, Workstation, and Fusion versions where HGFS (Shared Folders) is enabled.

Q3. What temporary mitigations or workarounds exist for CVE-2025-22226 before patching?

[Mitigation] Apply the official security patches provided by Broadcom, or disable the HGFS (Shared Folders) feature in the virtual machine configuration as a temporary workaround. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION