CVSS 3.1
6.0 mediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:NCVE-2025-22226
Medium (6.0) in VMware ESXi, Workstation, and Fusion. In CISA KEV since 2025-03-04. EPSS 1.6% chance of exploitation in the next 30 days.
VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. A malicious actor with administrative privileges to a virtual machine may be able to exploit this issue to leak memory from the vmx process.
Severity
- EPSS
- 1.6% chance of exploitation in the next 30 days; higher than 76% of CVEs (scores of 2026-10-31)
- CISA KEV
- listed 2025-03-04, due 2025-03-25
- CWE
- CWE-125
- Published
- Modified
- Record from
- the NVD, synced
Affected
- vmware:cloud_foundation
- vmware:esxi
- vmware:fusion
- vmware:telco_cloud_infrastructure
- vmware:telco_cloud_platform
- vmware:workstation