InfoSecBulletin Cybersecurity for mankind
Broadcom issued a security alert on Tuesday, warning VMware customers about 3 exploited zero-day vulnerabilities. Vulnerabilities CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226 affect VMware ESXi, Workstation, and Fusion. Patches have been released for all affected products, but no workarounds are available.
CVE-2025-22224 is a critical VMCI heap overflow vulnerability in VMware ESXi and Workstation. It allows an attacker with local admin rights on a virtual machine to execute code as the VMX process on the host.
CVSS 9.6: IBM QRadar & Cloud Pak Security Flaws Exposed
ALERT
Thousands of IP addresses compromised nationwide: CIRT warn
New Android Malware ‘Crocodilus’ Targets Banks in 8 Countries
Qualcomm Patches 3 Zero-Days Used in Targeted Android Attacks
Critical RCE Flaw Patched in Roundcube Webmail
Hacker claim Leak of Deloitte Source Code & GitHub Credentials
CISA Issued Guidance for SIEM and SOAR Implementation
Linux flaws enable password hash theft via core dumps in Ubuntu, RHEL, Fedora
Australia enacts mandatory ransomware payment reporting
Why Govt Demands Foreign CCTV Firms to Submit Source Code?
CVE-2025-22225 is a high-severity vulnerability in VMware ESXi that enables an attacker with certain privileges in the VMX process to perform an arbitrary kernel write, potentially allowing them to escape the sandbox.
CVE-2025-22226 is a high-severity information disclosure vulnerability in VMware ESXi, Workstation, and Fusion. It results from an out-of-bounds read in the HGFS component, allowing an attacker with admin access to a VM to leak memory from the VMX process.
Broadcom, after acquiring VMware in 2023, noted that exploiting the vulnerabilities requires elevated privileges. This suggests they may have been used in targeted attacks after attackers gained initial access to the victim’s systems.
“This is a situation where an attacker who has already compromised a virtual machine’s guest OS and gained privileged access (administrator or root) could move into the hypervisor itself,” the vendor explained.
Broadcom acknowledges the Microsoft Threat Intelligence Center for reporting these vulnerabilities.
