Skip to main content
cvebuzz

CVE mentions, exploit signals, and PoC evidence in one fast public view.

CVE detail

CVE-2025-22224

VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.

CVSS 9.3 · CriticalBuzz score 71.4KEV listed

Buzz score

Why this CVE is surfacing

Buzz score total 71.4

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 26.4 · diversity 20.0 · KEV 25.0 · OTX 0.0 · PoC 0.0
Mention score
26.4
13 evidence mentions in the snapshot
Diversity score
20.0
7 sources across 4 categories
KEV score
25.0
Known exploited vulnerability present
OTX score
0.0
0 OTX pulses
PoC score
0.0
0 repos · best confidence N/A
Best PoC traction
0
Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions
0
within the 30d window
Peak daily
0
highest bucket

Evidence

Source links by recency

Newest mentions first
13 source links · newest first
  • CISA confirms exploitation of VMware ESXi flaw by ransomware attackersHelp Net Security

    CVE-2025-22225, a VMware ESXi arbitrary write vulnerability, is being used in ransomware campaigns, CISA confirmed on Wednesday by updating the vulnerability’s entry in its Known Exploited Vulnerabilities (KEV) catalog. Researchers linked VMware ESXi zero-day trio to single exploit toolkit Broadcom fixed CVE-2025-22225, CVE-2025-22224 (a heap overflow vulnerability) and CVE-2025-22226 (an information disclosure flaw) in VMware ESXi, Workstation, and Fusion in early March 2025. At the time of their disclosure, Broadcom said that they have information … More →

    newswww.helpnetsecurity.comFeb 5, 2026, 4:03 PM
  • CVE-2025-22225 in VMware ESXi now used in active ransomware attacksSecurity Affairs

    Ransomware groups now exploit VMware ESXi vulnerability CVE-2025-22225, patched by Broadcom in March 2025. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirms that ransomware gangs are exploiting the VMware ESXi sandbox escape flaw CVE-2025-22225. The vulnerability is an arbitrary write issue in VMware ESXi. An attackers with privileges within the VMX process may trigger an arbitrary […]

    newssecurityaffairs.comFeb 4, 2026, 10:02 PM
  • Exploit for VMware Zero-Day Flaws Likely Built a Year Before Public DisclosureSecurityWeek

    Fresh attacks targeted three VMware ESXi vulnerabilities that were disclosed in March 2025 as zero-days.

    newswww.securityweek.comJan 9, 2026, 11:34 AM
  • Chinese-speaking hackers exploited ESXi zero-days long before disclosureSecurity Affairs

    Chinese-speaking attackers used a hacked SonicWall VPN to deploy ESXi zero-days that were likely exploited over a year before public disclosure. Chinese-speaking attackers were seen abusing a hacked SonicWall VPN to deliver a toolkit targeting VMware ESXi. The exploit chain included a sophisticated VM escape and appears to have been developed more than a year […]

    newssecurityaffairs.comJan 9, 2026, 12:06 AM
  • Authentication bypass CVE-2025-22230 impacts VMware Windows ToolsSecurity Affairs

    Broadcom addressed a high-severity authentication bypass vulnerability, tracked as CVE-2025-22230, in VMware Tools for Windows. Broadcom released security updates to address a high-severity authentication bypass vulnerability, tracked as CVE-2025-22230 (CVSS score 9.8), impacting VMware Tools for Windows. VMware Tools for Windows is a suite of utilities that enhances the performance and usability of virtual machines […]

    newssecurityaffairs.comMar 26, 2025, 7:07 AM
  • 10th March – Threat Intelligence ReportCheck Point Research

    For the latest discoveries in cyber research for the week of 10th March, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES The City of Mission, Texas, has declared a local state of emergency following a severe cybersecurity incident that threatens to expose protected personal information, health records, and other critical data managed by […]

    vendorresearch.checkpoint.comMar 10, 2025, 2:45 PM
  • Exploited VMware ESXi Flaws Put Many at Risk of Ransomware, Other AttacksSecurityWeek

    Scans show that tens of thousands of VMware ESXi instances are affected by CVE-2025-22224 and other vulnerabilities disclosed recently as zero-days.

    newswww.securityweek.comMar 6, 2025, 9:51 AM
  • U.S. CISA adds Linux kernel and VMware ESXi and Workstation flaws to its Known Exploited Vulnerabilities catalogSecurity Affairs

    U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Linux kernel and VMware ESXi and Workstation flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: The first issue, tracked as CVE-2024-50302, was addressed by Google with the release of the Android […]

    newssecurityaffairs.comMar 5, 2025, 6:09 AM
  • VMware fixed three actively exploited zero-days in ESX productsSecurity Affairs

    Broadcom has addressed three VMware zero-day vulnerabilities in ESX products that are actively exploited in the wild. Broadcom released security updates to address three VMware zero-day vulnerabilities in ESX products that are actively exploited in the wild. The flaws, respectively tracked as CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226, impact multiple VMware ESX products, including VMware ESXi, vSphere, […]

    newssecurityaffairs.comMar 4, 2025, 11:39 PM
  • VMware ESXi gets critical patches for in-the-wild virtual machine escape attackCSO Online

    Broadcom released emergency patches for its VMware ESXi, Workstation, and Fusion products to fix three vulnerabilities that can lead to virtual machine escape and are actively being exploited by attackers. Products that include VMware ESXi, such as VMware vSphere, VMware Cloud Foundation, and VMware Telco Cloud Platform, are also impacted. VMware products, especially the ESXi […]

    newswww.csoonline.comMar 4, 2025, 7:45 PM
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-22224www.cisa.gov

    No excerpt available.

    Mitigationwww.cisa.govMar 4, 2025, 12:15 PM
  • https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390support.broadcom.com

    No excerpt available.

    Vendor Advisorysupport.broadcom.comMar 4, 2025, 12:15 PM
  • Broadcom Patches 3 VMware Zero-Days Exploited in the WildSecurityWeek

    Broadcom patched VMware zero-days CVE-2025-22224, CVE-2025-22225 and CVE-2025-22226 after Microsoft warned it of exploitation.

    newswww.securityweek.comMar 4, 2025, 12:13 PM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

0 repository references · best confidence N/A · max 0 stars
No public PoC repositories have been matched yet.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence