VMware Security Flaws Exploited in the Wild—Broadcom Releases Urgent Patches

Source: The Hacker News Author: info@thehackernews.com (The Hacker News) URL: https://thehackernews.com/2025/03/vmware-security-flaws-exploited-in.html

  1. ONE SENTENCE SUMMARY: Broadcom released security updates for actively exploited VMware ESXi, Workstation, and Fusion vulnerabilities that enable code execution and data leaks.

  2. MAIN POINTS:

  3. Broadcom patched three VMware security flaws actively exploited in the wild.

  4. CVE-2025-22224 allows code execution via a TOCTOU vulnerability with a CVSS score of 9.3.

  5. CVE-2025-22225 enables sandbox escape through an arbitrary write flaw with a CVSS score of 8.2.

  6. CVE-2025-22226 causes information disclosure via an out-of-bounds read with a CVSS score of 7.1.

  7. Affected products include VMware ESXi, Workstation, Fusion, Cloud Foundation, and Telco Cloud Platform.

  8. Fixed versions include ESXi 7.0U3s, ESXi 8.0U3d, Workstation 17.6.3, and Fusion 13.6.3.

  9. Microsoft Threat Intelligence Center discovered and reported these vulnerabilities.

  10. Broadcom confirmed real-world exploitation but did not disclose attack details or threat actor identities.

  11. Users are urged to apply patches immediately for protection against active threats.

  12. The vulnerabilities impact virtual machine security, potentially compromising host systems.

  13. TAKEAWAYS:

  14. Organizations using VMware products must urgently apply the latest security patches.

  15. Exploited vulnerabilities pose significant risks, including code execution and data leaks.

  16. Microsoft played a key role in identifying and reporting these security flaws.

  17. Broadcom acknowledged real-world exploitation but withheld specific attack details.

  18. Keeping virtualization infrastructure updated is crucial to mitigating security risks.