InfoSecBulletin Cybersecurity for mankind
Broadcom issued a security alert on Tuesday, warning VMware customers about 3 exploited zero-day vulnerabilities. Vulnerabilities CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226 affect VMware ESXi, Workstation, and Fusion. Patches have been released for all affected products, but no workarounds are available.
CVE-2025-22224 is a critical VMCI heap overflow vulnerability in VMware ESXi and Workstation. It allows an attacker with local admin rights on a virtual machine to execute code as the VMX process on the host.
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
Cl0p Ransomware Listed 40+ Victims of PTC Windchill Campaign
Oracle Issues 943 Security Patches, Including Critical WebLogic Flaw
CVE-2025-22225 is a high-severity vulnerability in VMware ESXi that enables an attacker with certain privileges in the VMX process to perform an arbitrary kernel write, potentially allowing them to escape the sandbox.
CVE-2025-22226 is a high-severity information disclosure vulnerability in VMware ESXi, Workstation, and Fusion. It results from an out-of-bounds read in the HGFS component, allowing an attacker with admin access to a VM to leak memory from the VMX process.
Broadcom, after acquiring VMware in 2023, noted that exploiting the vulnerabilities requires elevated privileges. This suggests they may have been used in targeted attacks after attackers gained initial access to the victim’s systems.
“This is a situation where an attacker who has already compromised a virtual machine’s guest OS and gained privileged access (administrator or root) could move into the hypervisor itself,” the vendor explained.
Broadcom acknowledges the Microsoft Threat Intelligence Center for reporting these vulnerabilities.
