InfoSecBulletin Cybersecurity for mankind
Broadcom issued a security alert on Tuesday, warning VMware customers about 3 exploited zero-day vulnerabilities. Vulnerabilities CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226 affect VMware ESXi, Workstation, and Fusion. Patches have been released for all affected products, but no workarounds are available.
CVE-2025-22224 is a critical VMCI heap overflow vulnerability in VMware ESXi and Workstation. It allows an attacker with local admin rights on a virtual machine to execute code as the VMX process on the host.
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
Shinyhunters claimed and set deadline to publish E&Y data
Microsoft, NVIDIA and CrowdStrike Initiate Alliance for Open-Source AI Security
Google Search Results Reportedly Show Claude AI Shared Chats
CVE-2025-22225 is a high-severity vulnerability in VMware ESXi that enables an attacker with certain privileges in the VMX process to perform an arbitrary kernel write, potentially allowing them to escape the sandbox.
CVE-2025-22226 is a high-severity information disclosure vulnerability in VMware ESXi, Workstation, and Fusion. It results from an out-of-bounds read in the HGFS component, allowing an attacker with admin access to a VM to leak memory from the VMX process.
Broadcom, after acquiring VMware in 2023, noted that exploiting the vulnerabilities requires elevated privileges. This suggests they may have been used in targeted attacks after attackers gained initial access to the victim’s systems.
“This is a situation where an attacker who has already compromised a virtual machine’s guest OS and gained privileged access (administrator or root) could move into the hypervisor itself,” the vendor explained.
Broadcom acknowledges the Microsoft Threat Intelligence Center for reporting these vulnerabilities.
