CVE-2025-22226

HIGH

VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. A malicious actor with administrative privileges to a virtual machine may be able to exploit this issue to leak memory from the vmx process.

CVSS v3.1 Score

7.1
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Attack Vector
LOCAL
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE
Published: 3/4/2025Modified: 6/17/2026

Related Intelligence (1)

MEDIUMVulnerability

Vulnerability Analysis of CVE-2025-22226: Information Disclosure Due to OOB Read in VMware’s HGFS

[object Object]

CVE-2025-22226
r/blueteamsec

References (2)

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390Vendor Advisoryhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-22226US Government Resource