Out-of-bounds write in VMware ESXi
Priority CRITICAL 95Exploited in the wildCWE-123Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.
Summary
VMware ESXi contains an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may trigger an arbitrary kernel write leading to an escape of the sandbox.
Why it matters now
Exploitation Active In CISA KEV since 2025-03-04CISA due date 2025-03-25Known ransomware use
EPSS 0.01016 63rd percentileScored 2026-11-07
Fix Fixed VMware ESXi: ESXi80U3d-24585383, ESXi80U2d-24585300, ESXi70U3s-24585291
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | VMware ESXi | 8.0 to before ESXi80U3d-24585383; 8.0 to before ESXi80U2d-24585300; 7.0 to before ESXi70U3s-24585291 | ESXi80U3d-24585383, ESXi80U2d-24585300, ESXi70U3s-24585291 | Patch available | CNA |
| — | VMware Cloud Foundation | 5.x, 4.5.x | — | No fix listed | CNA |
| — | VMware Telco Cloud Platform | 5.x, 4.x, 3.x, 2.x | — | No fix listed | CNA |
| — | VMware Telco Cloud Infrastructure | 3.x, 2.x | — | No fix listed | CNA |
- VMware ESXi Vendor— Affected 8.0 to before ESXi80U3d-24585383; 8.0 to before ESXi80U2d-24585300; 7.0 to before ESXi70U3s-24585291 Fixed in ESXi80U3d-24585383, ESXi80U2d-24585300, ESXi70U3s-24585291 Patch available CNA
- VMware Cloud Foundation Vendor— Affected 5.x, 4.5.x Fixed in — No fix listed CNA
- VMware Telco Cloud Platform Vendor— Affected 5.x, 4.x, 3.x, 2.x Fixed in — No fix listed CNA
- VMware Telco Cloud Infrastructure Vendor— Affected 3.x, 2.x Fixed in — No fix listed CNA
CPE configurations NVD · 55
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:vmware:esxi:7.0:-:*:*:*:*:*:* | 7.0 | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:beta:*:*:*:*:*:* | 7.0 beta | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_1:*:*:*:*:*:* | 7.0 update_1 | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_1a:*:*:*:*:*:* | 7.0 update_1a | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_1b:*:*:*:*:*:* | 7.0 update_1b | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_1c:*:*:*:*:*:* | 7.0 update_1c | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_1d:*:*:*:*:*:* | 7.0 update_1d | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_1e:*:*:*:*:*:* | 7.0 update_1e | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_2:*:*:*:*:*:* | 7.0 update_2 | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_2a:*:*:*:*:*:* | 7.0 update_2a | Vulnerable | VMware |
- cpe:2.3:o:vmware:esxi:7.0:-:*:*:*:*:*:* Versions 7.0 Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:beta:*:*:*:*:*:* Versions 7.0 beta Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_1:*:*:*:*:*:* Versions 7.0 update_1 Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_1a:*:*:*:*:*:* Versions 7.0 update_1a Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_1b:*:*:*:*:*:* Versions 7.0 update_1b Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_1c:*:*:*:*:*:* Versions 7.0 update_1c Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_1d:*:*:*:*:*:* Versions 7.0 update_1d Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_1e:*:*:*:*:*:* Versions 7.0 update_1e Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_2:*:*:*:*:*:* Versions 7.0 update_2 Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_2a:*:*:*:*:*:* Versions 7.0 update_2a Vulnerable ·VMware
Show 45 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:vmware:esxi:7.0:update_2c:*:*:*:*:*:* | 7.0 update_2c | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_2d:*:*:*:*:*:* | 7.0 update_2d | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_2e:*:*:*:*:*:* | 7.0 update_2e | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3:*:*:*:*:*:* | 7.0 update_3 | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3c:*:*:*:*:*:* | 7.0 update_3c | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3d:*:*:*:*:*:* | 7.0 update_3d | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3e:*:*:*:*:*:* | 7.0 update_3e | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3f:*:*:*:*:*:* | 7.0 update_3f | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3g:*:*:*:*:*:* | 7.0 update_3g | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3i:*:*:*:*:*:* | 7.0 update_3i | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3j:*:*:*:*:*:* | 7.0 update_3j | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3k:*:*:*:*:*:* | 7.0 update_3k | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3l:*:*:*:*:*:* | 7.0 update_3l | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3m:*:*:*:*:*:* | 7.0 update_3m | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3n:*:*:*:*:*:* | 7.0 update_3n | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3o:*:*:*:*:*:* | 7.0 update_3o | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3p:*:*:*:*:*:* | 7.0 update_3p | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3q:*:*:*:*:*:* | 7.0 update_3q | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:7.0:update_3r:*:*:*:*:*:* | 7.0 update_3r | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:8.0:-:*:*:*:*:*:* | 8.0 | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:8.0:a:*:*:*:*:*:* | 8.0 a | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:8.0:b:*:*:*:*:*:* | 8.0 b | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:8.0:c:*:*:*:*:*:* | 8.0 c | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:8.0:update_1:*:*:*:*:*:* | 8.0 update_1 | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:8.0:update_1a:*:*:*:*:*:* | 8.0 update_1a | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:8.0:update_1c:*:*:*:*:*:* | 8.0 update_1c | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:8.0:update_1d:*:*:*:*:*:* | 8.0 update_1d | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:8.0:update_2:*:*:*:*:*:* | 8.0 update_2 | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:8.0:update_2b:*:*:*:*:*:* | 8.0 update_2b | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:8.0:update_2c:*:*:*:*:*:* | 8.0 update_2c | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:8.0:update_3:*:*:*:*:*:* | 8.0 update_3 | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:8.0:update_3b:*:*:*:*:*:* | 8.0 update_3b | Vulnerable | VMware |
| cpe:2.3:o:vmware:esxi:8.0:update_3c:*:*:*:*:*:* | 8.0 update_3c | Vulnerable | VMware |
| cpe:2.3:a:vmware:cloud_foundation:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | VMware |
| cpe:2.3:a:vmware:telco_cloud_infrastructure:2.2:*:*:*:*:*:*:* | 2.2 | Vulnerable | VMware |
| cpe:2.3:a:vmware:telco_cloud_infrastructure:2.5:*:*:*:*:*:*:* | 2.5 | Vulnerable | VMware |
| cpe:2.3:a:vmware:telco_cloud_infrastructure:2.7:*:*:*:*:*:*:* | 2.7 | Vulnerable | VMware |
| cpe:2.3:a:vmware:telco_cloud_infrastructure:3.0:*:*:*:*:*:*:* | 3.0 | Vulnerable | VMware |
| cpe:2.3:a:vmware:telco_cloud_platform:2.0:*:*:*:*:*:*:* | 2.0 | Vulnerable | VMware |
| cpe:2.3:a:vmware:telco_cloud_platform:2.5:*:*:*:*:*:*:* | 2.5 | Vulnerable | VMware |
| cpe:2.3:a:vmware:telco_cloud_platform:2.7:*:*:*:*:*:*:* | 2.7 | Vulnerable | VMware |
| cpe:2.3:a:vmware:telco_cloud_platform:3.0:*:*:*:*:*:*:* | 3.0 | Vulnerable | VMware |
| cpe:2.3:a:vmware:telco_cloud_platform:4.0:*:*:*:*:*:*:* | 4.0 | Vulnerable | VMware |
| cpe:2.3:a:vmware:telco_cloud_platform:4.0.1:*:*:*:*:*:*:* | 4.0.1 | Vulnerable | VMware |
| cpe:2.3:a:vmware:telco_cloud_platform:5.0:*:*:*:*:*:*:* | 5.0 | Vulnerable | VMware |
- cpe:2.3:o:vmware:esxi:7.0:update_2c:*:*:*:*:*:* Versions 7.0 update_2c Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_2d:*:*:*:*:*:* Versions 7.0 update_2d Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_2e:*:*:*:*:*:* Versions 7.0 update_2e Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3:*:*:*:*:*:* Versions 7.0 update_3 Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3c:*:*:*:*:*:* Versions 7.0 update_3c Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3d:*:*:*:*:*:* Versions 7.0 update_3d Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3e:*:*:*:*:*:* Versions 7.0 update_3e Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3f:*:*:*:*:*:* Versions 7.0 update_3f Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3g:*:*:*:*:*:* Versions 7.0 update_3g Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3i:*:*:*:*:*:* Versions 7.0 update_3i Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3j:*:*:*:*:*:* Versions 7.0 update_3j Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3k:*:*:*:*:*:* Versions 7.0 update_3k Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3l:*:*:*:*:*:* Versions 7.0 update_3l Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3m:*:*:*:*:*:* Versions 7.0 update_3m Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3n:*:*:*:*:*:* Versions 7.0 update_3n Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3o:*:*:*:*:*:* Versions 7.0 update_3o Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3p:*:*:*:*:*:* Versions 7.0 update_3p Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3q:*:*:*:*:*:* Versions 7.0 update_3q Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:7.0:update_3r:*:*:*:*:*:* Versions 7.0 update_3r Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:8.0:-:*:*:*:*:*:* Versions 8.0 Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:8.0:a:*:*:*:*:*:* Versions 8.0 a Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:8.0:b:*:*:*:*:*:* Versions 8.0 b Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:8.0:c:*:*:*:*:*:* Versions 8.0 c Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:8.0:update_1:*:*:*:*:*:* Versions 8.0 update_1 Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:8.0:update_1a:*:*:*:*:*:* Versions 8.0 update_1a Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:8.0:update_1c:*:*:*:*:*:* Versions 8.0 update_1c Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:8.0:update_1d:*:*:*:*:*:* Versions 8.0 update_1d Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:8.0:update_2:*:*:*:*:*:* Versions 8.0 update_2 Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:8.0:update_2b:*:*:*:*:*:* Versions 8.0 update_2b Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:8.0:update_2c:*:*:*:*:*:* Versions 8.0 update_2c Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:8.0:update_3:*:*:*:*:*:* Versions 8.0 update_3 Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:8.0:update_3b:*:*:*:*:*:* Versions 8.0 update_3b Vulnerable ·VMware
- cpe:2.3:o:vmware:esxi:8.0:update_3c:*:*:*:*:*:* Versions 8.0 update_3c Vulnerable ·VMware
- cpe:2.3:a:vmware:cloud_foundation:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·VMware
- cpe:2.3:a:vmware:telco_cloud_infrastructure:2.2:*:*:*:*:*:*:* Versions 2.2 Vulnerable ·VMware
- cpe:2.3:a:vmware:telco_cloud_infrastructure:2.5:*:*:*:*:*:*:* Versions 2.5 Vulnerable ·VMware
- cpe:2.3:a:vmware:telco_cloud_infrastructure:2.7:*:*:*:*:*:*:* Versions 2.7 Vulnerable ·VMware
- cpe:2.3:a:vmware:telco_cloud_infrastructure:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·VMware
- cpe:2.3:a:vmware:telco_cloud_platform:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·VMware
- cpe:2.3:a:vmware:telco_cloud_platform:2.5:*:*:*:*:*:*:* Versions 2.5 Vulnerable ·VMware
- cpe:2.3:a:vmware:telco_cloud_platform:2.7:*:*:*:*:*:*:* Versions 2.7 Vulnerable ·VMware
- cpe:2.3:a:vmware:telco_cloud_platform:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·VMware
- cpe:2.3:a:vmware:telco_cloud_platform:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·VMware
- cpe:2.3:a:vmware:telco_cloud_platform:4.0.1:*:*:*:*:*:*:* Versions 4.0.1 Vulnerable ·VMware
- cpe:2.3:a:vmware:telco_cloud_platform:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·VMware
Remediation
- Fix · CNA VMware ESXi Fixed in ESXi80U3d-24585383, ESXi80U2d-24585300, ESXi70U3s-24585291
Timeline
- 2025-03-04 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2025-22225
- 2026-10-03 Alias added: GHSA-2cxw-wgvv-24jj
References
More VMware Cloud Foundation vulnerabilities
- TI-2024-26040 Privilege escalation in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
- TI-2024-26039 Heap-overflow in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
- TI-2024-24610 Out-of-bounds write in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
- TI-2022-07131 Code injection in VMware Workspace ONE Access and Identity Manager KEVCVSS 3.1CRITICAL 9.8
- TI-2021-05049 Path traversal in VMware vCenter Server, VMware Cloud Foundation KEVCVSS 3.1CRITICAL 9.8
- TI-2021-05029 Improper input validation in VMware vCenter Server and VMware Cloud Foundation KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-22225 · CVE Program
- CVE-2025-22225 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-2cxw-wgvv-24jj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences