Security readout for executives and security teams
Plain-English summary
This vulnerability can let a malicious administrator inside a virtual machine read memory from VMware's host-side vmx process. That memory exposure can reveal sensitive data across a trust boundary. CISA lists CVE-2025-22226 in KEV, so treat it as actively exploited, not theoretical.
Executive priority
High priority. The issue affects virtualization infrastructure, crosses a VM boundary, and is in CISA KEV. Remediate on a tracked timeline, especially for shared, regulated, or high-value environments.
Technical view
CVE-2025-22226 is a CWE-125 out-of-bounds read in HGFS affecting VMware ESXi, Workstation, Fusion, Cloud Foundation, and Telco Cloud products. The stated impact is confidentiality loss: a VM-local actor may leak vmx process memory. CVSS is 7.1 high with changed scope and high confidentiality impact.
Likely exposure
Exposure is likely where affected VMware versions run guest VMs with HGFS-related functionality, including ESXi 7.0/8.0, Workstation 17.x, Fusion 13.x, and bundled VMware platform stacks listed by Broadcom.
Exploitation context
Active exploitation is supported by the CISA KEV listing. The source bundle does not provide exploit details, observed campaigns, affected configurations beyond product versions, or confirmed public exploit code.
Researcher notes
Evidence supports an HGFS out-of-bounds read leading to vmx memory disclosure. The bundle does not include fixed build numbers, workaround details, exploit mechanics, or telemetry. Use Broadcom and CISA records as controlling sources.
Mitigation direction
- Prioritize remediation because CISA KEV confirms exploitation.
- Review Broadcom advisory VMSA-2025-0004 for fixed versions and workarounds.
- Patch affected ESXi, Workstation, Fusion, and bundled VMware platform deployments.
- Assess whether HGFS-related functionality is required and restrict it where vendor guidance permits.
- Track remediation for VMware Cloud Foundation and Telco Cloud through their product guidance.
Validation and detection
- Inventory VMware ESXi, Workstation, Fusion, Cloud Foundation, and Telco Cloud versions.
- Map deployed versions against the affected product ranges in the advisory.
- Confirm whether remediation from Broadcom has been applied on every affected host.
- Review virtualization logs for unusual guest-to-host activity where available.
- Document exceptions and compensating controls for any systems awaiting vendor remediation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-125: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-22226 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N2.54Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390CVE reference
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-22226CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Read
Out-of-bounds Read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.