CVE-2025-22225
VMware ESXi Arbitrary Write Vulnerability
Description
CVE-2025-22225 is a high-severity arbitrary write vulnerability in VMware ESXi that enables sandbox escape from the VMX process to the hypervisor kernel. A malicious actor with privileges within the VMX process can trigger an arbitrary kernel write, leading to a complete escape from the virtual machine sandbox. With a CVSS v3.1 base score of 8.2 and confirmed active exploitation in the wild, CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of March 25, 2025. The EPSS score of 6.04% at the 90th percentile indicates significantly elevated exploitation probability, and CISA has confirmed this vulnerability is known to be used in ransomware campaigns.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| vmware | esxi | 7.0; 8.0 |
| vmware | cloud foundation | - |
| vmware | telco cloud infrastructure | 2.2; 2.5; 2.7; 3.0 |
| vmware | telco cloud platform | 2.0; 2.5; 2.7; 3.0; 4.0; 4.0.1; 5.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
References
Weakness Type
Arbitrary Write / Out-of-Bounds Write
CVE-2025-22225 involves an arbitrary write primitive in the VMware ESXi hypervisor kernel. An arbitrary write vulnerability allows an attacker to write data to an arbitrary memory location, bypassing normal access controls and memory safety boundaries. In this case, the vulnerability resides in how the ESXi kernel processes requests from the VMX process, enabling a privileged attacker within the VMX context to write to kernel memory addresses that should not be accessible from the virtualization user-space layer. This class of vulnerability is closely related to CWE-787 (Out-of-bounds Write), where software writes data past the intended buffer boundaries.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2025-22225 represents one of the most severe classes of hypervisor vulnerabilities — a sandbox escape from a virtual machine to the underlying host. The vulnerability requires local access (AV:L) with low attack complexity (AC:L) and high privileges within the VMX process (PR:H), but requires no user interaction (UI:N). The scope is changed (S:C), indicating the attacker can break out of the virtual machine boundary to impact the host. Confidentiality (High): Once kernel-level write access is achieved, an attacker can access all memory on the ESXi host, including data from every virtual machine running on that host. Integrity (High): Arbitrary kernel writes enable modification of hypervisor code and configuration, installation of persistent rootkits, and manipulation of other virtual machines. Availability (High): Full kernel access allows the attacker to crash the hypervisor, terminate all hosted virtual machines, or deploy destructive payloads. The confirmed association with ransomware campaigns makes this vulnerability particularly dangerous for enterprise environments. Combined with CVE-2025-22224 (TOCTOU leading to code execution) and CVE-2025-22226 (information disclosure), this vulnerability completes a full attack chain from guest VM to hypervisor control. With an EPSS score of 6.04%, organizations running VMware ESXi face an elevated and immediate risk of exploitation.
Exploit Maturity
CVE-2025-22225 exhibits confirmed active exploitation with maximum threat severity. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog and has explicitly confirmed its use in ransomware campaigns, making it one of the few hypervisor vulnerabilities with confirmed ransomware association. The vulnerability was disclosed alongside CVE-2025-22224 and CVE-2025-22226, forming a potent attack chain: CVE-2025-22224 provides initial code execution within the VMX process, CVE-2025-22226 leaks host memory for intelligence gathering, and CVE-2025-22225 delivers the final sandbox escape through arbitrary kernel writes. The EPSS score of 6.04% at the 90th percentile reflects significant real-world exploitation activity. Broadcom has published a security advisory documenting the vulnerability and available remediation measures.
Remediation
-
Apply ESXi patches immediately. Broadcom has released security patches for ESXi 7.0 and 8.0 addressing CVE-2025-22225. Apply the latest ESXi patches as documented in VMSA-2025-0004. Given the confirmed ransomware association, this patch should be treated as an emergency priority.
-
Update VMware Cloud Foundation deployments. Cloud Foundation environments that include ESXi must apply the corresponding async patches. Telco Cloud Infrastructure versions 2.2 through 3.0 and Telco Cloud Platform versions 2.0 through 5.0 also require updates.
-
Isolate and audit ESXi management interfaces. Ensure ESXi management networks are segmented from general network traffic and virtual machine networks. Restrict access to the VMX process and hypervisor management through strict firewall rules and VLAN segmentation.
-
Conduct immediate forensic analysis. Given the confirmed ransomware association, organizations should review ESXi host logs for signs of compromise, check for unauthorized kernel modules, and inspect virtual machine configurations for evidence of tampering. Look for indicators of the full exploitation chain involving CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226.
-
Implement defense-in-depth measures. Enable ESXi lockdown mode to restrict direct host access. Deploy host-based monitoring for hypervisor integrity. Ensure virtual machine backups are stored offline and tested regularly to enable recovery from potential ransomware attacks targeting the hypervisor.
Technical Details
CVE-2025-22225 is an arbitrary write vulnerability in the VMware ESXi hypervisor kernel. The CVSS v3.1 vector string CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H indicates that while the attack requires local access and high privileges within the VMX process, it achieves changed scope with maximum impact on confidentiality, integrity, and availability. The vulnerability exists in the interface between the VMX process (the user-space component managing virtual machine execution) and the ESXi kernel (the hypervisor itself). When processing certain requests from the VMX process, the kernel fails to properly validate write destinations, allowing an attacker with VMX-level privileges to write arbitrary data to arbitrary kernel memory locations. This arbitrary kernel write primitive enables a complete sandbox escape — the attacker transitions from operating within the constrained VMX process to executing code with full hypervisor kernel privileges. The attack mechanism involves corrupting kernel data structures or code pointers to redirect execution flow, ultimately granting the attacker unrestricted access to the entire ESXi host, all hosted virtual machines, and all connected storage. The requirement for VMX-level privileges (PR:H) means this vulnerability is typically chained with CVE-2025-22224, which provides the initial foothold within the VMX process through a TOCTOU race condition.
Frequently Asked Questions
Is CVE-2025-22225 being used in ransomware attacks?
Yes. CISA has explicitly confirmed that CVE-2025-22225 is known to be used in ransomware campaigns. This makes it one of the most critical hypervisor vulnerabilities to remediate, as successful exploitation grants attackers control over the ESXi host and all hosted virtual machines, enabling mass encryption of VM storage.
What products are affected by CVE-2025-22225?
CVE-2025-22225 specifically affects VMware ESXi versions 7.0 and 8.0, VMware Cloud Foundation, and VMware Telco Cloud Infrastructure and Platform across multiple versions. Unlike CVE-2025-22224 and CVE-2025-22226, this vulnerability does not affect VMware Workstation or Fusion, as it targets the ESXi-specific hypervisor kernel.
How does CVE-2025-22225 relate to CVE-2025-22224 and CVE-2025-22226?
The three vulnerabilities form a complete attack chain. CVE-2025-22224 enables initial code execution in the VMX process through a TOCTOU condition. CVE-2025-22226 provides information disclosure through an HGFS out-of-bounds read, leaking host memory for reconnaissance. CVE-2025-22225 delivers the final sandbox escape through arbitrary kernel writes, granting full hypervisor control.
How do I fix CVE-2025-22225?
Apply the security patches released by Broadcom for ESXi 7.0 and 8.0 as documented in advisory VMSA-2025-0004. Cloud Foundation and Telco Cloud environments require corresponding async patches. Given the confirmed ransomware association, patching should be treated as an emergency priority with immediate deployment.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.