Time-of-check time-of-use race condition in VMware ESXi
Priority CRITICAL 99Exploited in the wildCWE-367Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.
Why it matters now
Exploitation Active In CISA KEV since 2025-03-04CISA due date 2025-03-25
EPSS 0.01561 75th percentileScored 2026-11-07
Fix Fixed ESXi (VMware): ESXi80U3d-24585383, ESXi80U2d-24585300, ESXi70U3s-24585291Workstation (VMware): 17.6.3
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| VMware | ESXi | 8.0 to before ESXi80U3d-24585383; 8.0 to before ESXi80U2d-24585300; 7.0 to before ESXi70U3s-24585291 | ESXi80U3d-24585383, ESXi80U2d-24585300, ESXi70U3s-24585291 | Patch available | CNA |
| VMware | Workstation | 17.x to before 17.6.3 | 17.6.3 | Patch available | CNA |
| VMware | VMware Cloud Foundation | 5.x, 4.5.x | — | No fix listed | CNA |
| VMware | Telco Cloud Platform | 5.x, 4.x, 3.x, 2.x | — | No fix listed | CNA |
| VMware | Telco Cloud Infrastructure | 3.x, 2.x | — | No fix listed | CNA |
- ESXi VendorVMware Affected 8.0 to before ESXi80U3d-24585383; 8.0 to before ESXi80U2d-24585300; 7.0 to before ESXi70U3s-24585291 Fixed in ESXi80U3d-24585383, ESXi80U2d-24585300, ESXi70U3s-24585291 Patch available CNA
- Workstation VendorVMware Affected 17.x to before 17.6.3 Fixed in 17.6.3 Patch available CNA
- VMware Cloud Foundation VendorVMware Affected 5.x, 4.5.x Fixed in — No fix listed CNA
- Telco Cloud Platform VendorVMware Affected 5.x, 4.x, 3.x, 2.x Fixed in — No fix listed CNA
- Telco Cloud Infrastructure VendorVMware Affected 3.x, 2.x Fixed in — No fix listed CNA
CPE configurations NVD · 56
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:vmware:esxi:7.0:-:*:*:*:*:*:* | 7.0 | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:beta:*:*:*:*:*:* | 7.0 beta | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_1:*:*:*:*:*:* | 7.0 update_1 | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_1a:*:*:*:*:*:* | 7.0 update_1a | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_1b:*:*:*:*:*:* | 7.0 update_1b | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_1c:*:*:*:*:*:* | 7.0 update_1c | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_1d:*:*:*:*:*:* | 7.0 update_1d | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_1e:*:*:*:*:*:* | 7.0 update_1e | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_2:*:*:*:*:*:* | 7.0 update_2 | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_2a:*:*:*:*:*:* | 7.0 update_2a | Vulnerable | VMware |
- cpe:2.3:o:vmware:esxi:7.0:-:*:*:*:*:*:* Versions 7.0 Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:beta:*:*:*:*:*:* Versions 7.0 beta Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_1:*:*:*:*:*:* Versions 7.0 update_1 Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_1a:*:*:*:*:*:* Versions 7.0 update_1a Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_1b:*:*:*:*:*:* Versions 7.0 update_1b Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_1c:*:*:*:*:*:* Versions 7.0 update_1c Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_1d:*:*:*:*:*:* Versions 7.0 update_1d Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_1e:*:*:*:*:*:* Versions 7.0 update_1e Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_2:*:*:*:*:*:* Versions 7.0 update_2 Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_2a:*:*:*:*:*:* Versions 7.0 update_2a Vulnerable ·VMware
Show 46 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:vmware:esxi:7.0:update_2c:*:*:*:*:*:* | 7.0 update_2c | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_2d:*:*:*:*:*:* | 7.0 update_2d | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_2e:*:*:*:*:*:* | 7.0 update_2e | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3:*:*:*:*:*:* | 7.0 update_3 | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3c:*:*:*:*:*:* | 7.0 update_3c | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3d:*:*:*:*:*:* | 7.0 update_3d | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3e:*:*:*:*:*:* | 7.0 update_3e | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3f:*:*:*:*:*:* | 7.0 update_3f | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3g:*:*:*:*:*:* | 7.0 update_3g | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3i:*:*:*:*:*:* | 7.0 update_3i | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3j:*:*:*:*:*:* | 7.0 update_3j | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3k:*:*:*:*:*:* | 7.0 update_3k | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3l:*:*:*:*:*:* | 7.0 update_3l | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3m:*:*:*:*:*:* | 7.0 update_3m | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3n:*:*:*:*:*:* | 7.0 update_3n | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3o:*:*:*:*:*:* | 7.0 update_3o | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3p:*:*:*:*:*:* | 7.0 update_3p | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3q:*:*:*:*:*:* | 7.0 update_3q | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3r:*:*:*:*:*:* | 7.0 update_3r | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:8.0:-:*:*:*:*:*:* | 8.0 | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:8.0:a:*:*:*:*:*:* | 8.0 a | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:8.0:b:*:*:*:*:*:* | 8.0 b | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:8.0:c:*:*:*:*:*:* | 8.0 c | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:8.0:update_1:*:*:*:*:*:* | 8.0 update_1 | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:8.0:update_1a:*:*:*:*:*:* | 8.0 update_1a | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:8.0:update_1c:*:*:*:*:*:* | 8.0 update_1c | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:8.0:update_1d:*:*:*:*:*:* | 8.0 update_1d | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:8.0:update_2:*:*:*:*:*:* | 8.0 update_2 | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:8.0:update_2b:*:*:*:*:*:* | 8.0 update_2b | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:8.0:update_2c:*:*:*:*:*:* | 8.0 update_2c | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:8.0:update_3:*:*:*:*:*:* | 8.0 update_3 | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:8.0:update_3b:*:*:*:*:*:* | 8.0 update_3b | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:8.0:update_3c:*:*:*:*:*:* | 8.0 update_3c | Vulnerable | VMware |
| cpe:2.3:a:vmware:cloud_foundation:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | VMware |
| cpe:2.3:a:vmware:telco_cloud_infrastructure:2.2:*:*:*:*:*:*:* | 2.2 | Vulnerable | VMware |
| cpe:2.3:a:vmware:telco_cloud_infrastructure:2.5:*:*:*:*:*:*:* | 2.5 | Vulnerable | VMware |
| cpe:2.3:a:vmware:telco_cloud_infrastructure:2.7:*:*:*:*:*:*:* | 2.7 | Vulnerable | VMware |
| cpe:2.3:a:vmware:telco_cloud_infrastructure:3.0:*:*:*:*:*:*:* | 3.0 | Vulnerable | VMware |
| cpe:2.3:a:vmware:telco_cloud_platform:2.0:*:*:*:*:*:*:* | 2.0 | Vulnerable | VMware |
| cpe:2.3:a:vmware:telco_cloud_platform:2.5:*:*:*:*:*:*:* | 2.5 | Vulnerable | VMware |
| cpe:2.3:a:vmware:telco_cloud_platform:2.7:*:*:*:*:*:*:* | 2.7 | Vulnerable | VMware |
| cpe:2.3:a:vmware:telco_cloud_platform:3.0:*:*:*:*:*:*:* | 3.0 | Vulnerable | VMware |
| cpe:2.3:a:vmware:telco_cloud_platform:4.0:*:*:*:*:*:*:* | 4.0 | Vulnerable | VMware |
| cpe:2.3:a:vmware:telco_cloud_platform:4.0.1:*:*:*:*:*:*:* | 4.0.1 | Vulnerable | VMware |
| cpe:2.3:a:vmware:telco_cloud_platform:5.0:*:*:*:*:*:*:* | 5.0 | Vulnerable | VMware |
| cpe:2.3:a:vmware:workstation:*:*:*:*:*:*:*:* | 17.0 to before 17.6.3 | Vulnerable | VMware |
- cpe:2.3:o:vmware:esxi:7.0:update_2c:*:*:*:*:*:* Versions 7.0 update_2c Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_2d:*:*:*:*:*:* Versions 7.0 update_2d Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_2e:*:*:*:*:*:* Versions 7.0 update_2e Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3:*:*:*:*:*:* Versions 7.0 update_3 Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3c:*:*:*:*:*:* Versions 7.0 update_3c Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3d:*:*:*:*:*:* Versions 7.0 update_3d Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3e:*:*:*:*:*:* Versions 7.0 update_3e Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3f:*:*:*:*:*:* Versions 7.0 update_3f Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3g:*:*:*:*:*:* Versions 7.0 update_3g Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3i:*:*:*:*:*:* Versions 7.0 update_3i Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3j:*:*:*:*:*:* Versions 7.0 update_3j Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3k:*:*:*:*:*:* Versions 7.0 update_3k Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3l:*:*:*:*:*:* Versions 7.0 update_3l Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3m:*:*:*:*:*:* Versions 7.0 update_3m Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3n:*:*:*:*:*:* Versions 7.0 update_3n Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3o:*:*:*:*:*:* Versions 7.0 update_3o Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3p:*:*:*:*:*:* Versions 7.0 update_3p Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3q:*:*:*:*:*:* Versions 7.0 update_3q Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3r:*:*:*:*:*:* Versions 7.0 update_3r Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:8.0:-:*:*:*:*:*:* Versions 8.0 Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:8.0:a:*:*:*:*:*:* Versions 8.0 a Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:8.0:b:*:*:*:*:*:* Versions 8.0 b Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:8.0:c:*:*:*:*:*:* Versions 8.0 c Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:8.0:update_1:*:*:*:*:*:* Versions 8.0 update_1 Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:8.0:update_1a:*:*:*:*:*:* Versions 8.0 update_1a Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:8.0:update_1c:*:*:*:*:*:* Versions 8.0 update_1c Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:8.0:update_1d:*:*:*:*:*:* Versions 8.0 update_1d Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:8.0:update_2:*:*:*:*:*:* Versions 8.0 update_2 Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:8.0:update_2b:*:*:*:*:*:* Versions 8.0 update_2b Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:8.0:update_2c:*:*:*:*:*:* Versions 8.0 update_2c Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:8.0:update_3:*:*:*:*:*:* Versions 8.0 update_3 Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:8.0:update_3b:*:*:*:*:*:* Versions 8.0 update_3b Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:8.0:update_3c:*:*:*:*:*:* Versions 8.0 update_3c Vulnerable ·VMware
- cpe:2.3:a:vmware:cloud_foundation:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·VMware
- cpe:2.3:a:vmware:telco_cloud_infrastructure:2.2:*:*:*:*:*:*:* Versions 2.2 Vulnerable ·VMware
- cpe:2.3:a:vmware:telco_cloud_infrastructure:2.5:*:*:*:*:*:*:* Versions 2.5 Vulnerable ·VMware
- cpe:2.3:a:vmware:telco_cloud_infrastructure:2.7:*:*:*:*:*:*:* Versions 2.7 Vulnerable ·VMware
- cpe:2.3:a:vmware:telco_cloud_infrastructure:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·VMware
- cpe:2.3:a:vmware:telco_cloud_platform:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·VMware
- cpe:2.3:a:vmware:telco_cloud_platform:2.5:*:*:*:*:*:*:* Versions 2.5 Vulnerable ·VMware
- cpe:2.3:a:vmware:telco_cloud_platform:2.7:*:*:*:*:*:*:* Versions 2.7 Vulnerable ·VMware
- cpe:2.3:a:vmware:telco_cloud_platform:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·VMware
- cpe:2.3:a:vmware:telco_cloud_platform:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·VMware
- cpe:2.3:a:vmware:telco_cloud_platform:4.0.1:*:*:*:*:*:*:* Versions 4.0.1 Vulnerable ·VMware
- cpe:2.3:a:vmware:telco_cloud_platform:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·VMware
- cpe:2.3:a:vmware:workstation:*:*:*:*:*:*:*:* Versions 17.0 to before 17.6.3 Vulnerable ·VMware
Remediation
- Fix · CNA ESXi (VMware) Fixed in ESXi80U3d-24585383, ESXi80U2d-24585300, ESXi70U3s-24585291
- Fix · CNA Workstation (VMware) Fixed in 17.6.3
Timeline
- 2025-03-04 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2025-22224
- 2026-10-03 Alias added: GHSA-j652-46fv-w96g
References
More VMware Cloud Foundation vulnerabilities
- TI-2024-26040 Privilege escalation in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
- TI-2024-26039 Heap-overflow in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
- TI-2024-24610 Out-of-bounds write in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
- TI-2022-07131 Code injection in VMware Workspace ONE Access and Identity Manager KEVCVSS 3.1CRITICAL 9.8
- TI-2021-05049 Path traversal in VMware vCenter Server, VMware Cloud Foundation KEVCVSS 3.1CRITICAL 9.8
- TI-2021-05029 Improper input validation in VMware vCenter Server and VMware Cloud Foundation KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-22224 · CVE Program
- CVE-2025-22224 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-j652-46fv-w96g · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences