Multiple vulnerabilities in VMware Workstation

Published: 2025-03-04 | Updated: 2025-03-04

Risk	High
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2025-22224 CVE-2025-22226
CWE-ID	CWE-122 CWE-125
Exploitation vector	Network
Public exploit	Vulnerability #1 is being exploited in the wild. Vulnerability #2 is being exploited in the wild.
Vulnerable software	VMware Workstation Client/Desktop applications / Virtualization software
Vendor	VMware, Inc

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Heap-based buffer overflow

EUVDB-ID: #VU105278

Risk: High

CVSSv4.0: 6.4 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:A/U:Amber]

CVE-ID: CVE-2025-22224

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a malicious guest to execute arbitrary code on the hypervisor.

The vulnerability exists due to a boundary error in VMCI. A malicious guest with administrative privileges can trigger a heap-based buffer overflow and execute arbitrary code on the hypervisor in the context of VMX process.

Note, the vulnerability is being actively exploited in the wild.

Mitigation

Install update from vendor's website.

Vulnerable software versions

VMware Workstation: 17.0 - 17.6.2

CPE2.3

External links

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to open a a specially crafted file.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

2) Out-of-bounds read

EUVDB-ID: #VU105280