CVE-2025-22224

CVE-2025-22224 is a TOCTOU (Time-of-Check Time-of-Use) race condition in VMware ESXi and Workstation that leads to an out-of-bounds write. The CVSS v3.1 vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H reflects local access with maximum impact across all three security objectives and changed scope, indicating cross-boundary impact from guest to host. The vulnerability exists in the mechanism that manages data transfers between the guest virtual machine and the VMX process on the host. A TOCTOU race condition occurs when the system checks a condition (such as buffer size or memory bounds) and then uses the result of that check at a later time, during which an attacker has modified the underlying data. In this case, the attacker can win the race between the validation check and the subsequent memory operation, causing the system to write data to a location outside the intended buffer. This out-of-bounds write corrupts VMX process memory structures, enabling the attacker to overwrite function pointers or other control data to redirect execution flow. The result is arbitrary code execution within the VMX process, which runs on the host with privileges sufficient to manage the virtual machine. Although the attack complexity is rated low (AC:L), the TOCTOU race can be reliably won because the attacker controls the timing from within the guest VM, making exploitation deterministic in practice.