{"cveID":"CVE-2025-22226","vendorProject":"VMware","product":"ESXi, Workstation, and Fusion","vulnerabilityName":"VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability","dateAdded":"2025-03-04","shortDescription":"VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. Successful exploitation allows an attacker with administrative privileges to a virtual machine to leak memory from the vmx process.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","dueDate":"2025-03-25","knownRansomwareCampaignUse":"Unknown","notes":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390 ; https://nvd.nist.gov/vuln/detail/CVE-2025-22226","cwes":["CWE-125"],"year":2025,"state":"mapped","stale_reasons":[],"mappings":[{"domain":"enterprise","cve":"CVE-2025-22226","technique":"T1005","technique_name_at_mapping":"Data from Local System","mapping_type":"primary_impact","capability_group":"oob","comments":"This vulnerability, present in VMWare ESXi, Workstation, and Fusion, is the result of an out-of-bounds read in the Host Guest File System (HGFS) and can be exploited by attackers with administrative privileges to disclose sensitive information from the VMX process. An attacker could then move into the hypervisor itself.","references":["https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390"," https://westoahu.hawaii.edu/cyber/vulnerability-research/vulnerabilities-weekly-summaries/attacks-on-vmware-esxi/#:~:text=all%20impacted%20products.-","Exploitation","of%20VMs%20compromising%20the%20host."],"status":"complete","source_file":"kev-07.28.2025_attack-16.1-enterprise.json","attack_version":"16.1","kev_snapshot":"07/28/2025"},{"domain":"enterprise","cve":"CVE-2025-22226","technique":"T1611","technique_name_at_mapping":"Escape to Host","mapping_type":"secondary_impact","capability_group":"oob","comments":"This vulnerability, present in VMWare ESXi, Workstation, and Fusion, is the result of an out-of-bounds read in the Host Guest File System (HGFS) and can be exploited by attackers with administrative privileges to disclose sensitive information from the VMX process. An attacker could then move into the hypervisor itself.","references":["https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390"," https://westoahu.hawaii.edu/cyber/vulnerability-research/vulnerabilities-weekly-summaries/attacks-on-vmware-esxi/#:~:text=all%20impacted%20products.-","Exploitation","of%20VMs%20compromising%20the%20host."],"status":"complete","source_file":"kev-07.28.2025_attack-16.1-enterprise.json","attack_version":"16.1","kev_snapshot":"07/28/2025"}],"techniques":[{"id":"T1005","domains":["enterprise"],"in_current_bundle":true,"live":true,"name_now":"Data from Local System","name_at_mapping":"Data from Local System","renamed":false,"revoked_by":null,"mapping_types":["primary_impact"],"sigma_rule_count":14,"has_detection_strategy":true},{"id":"T1611","domains":["enterprise"],"in_current_bundle":true,"live":true,"name_now":"Escape to Host","name_at_mapping":"Escape to Host","renamed":false,"revoked_by":null,"mapping_types":["secondary_impact"],"sigma_rule_count":2,"has_detection_strategy":true}],"mapping_types":["primary_impact","secondary_impact"],"has_exploitation_technique":false,"mapping_attack_versions":["16.1"],"mapping_domains":["enterprise"],"sigma_coverage":"full","sigma_rules_tagged_cve":[],"added_after_mapping_snapshot":false,"_source":"kevmap","_built":"2026-08-23 05:47 UTC","_attack_version":"19.2"}