Broadcom published VMSA-2025-0004 on March 4, 2025, for three vulnerabilities affecting VMware ESXi and related desktop and cloud products. Fixed versions are available, and the advisory lists no workarounds for any of the three vulnerabilities.
The practical response is therefore straightforward: identify every affected product, move it to a fixed or later supported build using its supported update method, and verify the resulting build. Access restrictions and monitoring remain useful defense-in-depth controls, but they do not replace the update.
Fixed Versions
The following table reflects Broadcom’s VMSA response matrix. Where a newer supported update is available and compatible with your environment, use that newer update rather than treating the minimum fixed build as a preferred long-term target.
| Product | Affected branch | Minimum remediation listed by Broadcom |
|---|---|---|
| VMware ESXi | 8.0 | ESXi80U3d-24585383 or ESXi80U2d-24585300, depending on the maintained branch |
| VMware ESXi | 7.0 (EOGS) | ESXi70U3s-24585291 |
| VMware Workstation | 17.x | 17.6.3 |
| VMware Fusion | 13.x | 13.6.3 |
| VMware Cloud Foundation | 5.x | Async patch to ESXi80U3d-24585383 |
| VMware Cloud Foundation | 4.5.x (EOGS) | Async patch to ESXi70U3s-24585291 |
| VMware Telco Cloud Platform | 5.x, 4.x, 3.x, 2.x | Follow Broadcom KB 389385 |
| VMware Telco Cloud Infrastructure | 3.x, 2.x | Follow Broadcom KB 389385 |
The ESXi 7.0 and VCF 4.5.x entries record the advisory’s March 2025 minimum fixes; they are not current supported target releases. vSphere 7.0 reached End of General Support on October 2, 2025, and Broadcom’s current VCF release matrix places VCF 4.x under End of General Support. Unless a specific Extended Support agreement or Broadcom Support direction applies, plan migration to a supported release rather than stopping at those legacy builds.
Cloud Foundation administrators should use the VCF async-patching procedure linked from the advisory rather than independently applying an ESXi image that has not been accounted for in the VCF bill of materials. Also confirm hardware, firmware, driver, add-on, backup, replication, and management-product interoperability before beginning a production rollout.
The advisory is the source of truth if its matrix changes after this article is published.
Understand the Three Vulnerabilities Correctly
These vulnerabilities are related, but they do not all provide the same capability:
- CVE-2025-22224 — VMCI heap overflow: A malicious actor with local administrative privileges inside a VM may execute code as that VM’s VMX process on the host. Broadcom rates it Critical with a maximum CVSSv3 score of 9.3.
- CVE-2025-22225 — ESXi arbitrary write: An actor who already has privileges within the VMX process may trigger an arbitrary kernel write and escape the VMX sandbox. Broadcom rates it Important with a maximum CVSSv3 score of 8.2.
- CVE-2025-22226 — HGFS information disclosure: An actor with administrative privileges inside a VM may exploit an out-of-bounds read to disclose memory from the VMX process. Broadcom rates it Important with a maximum CVSSv3 score of 7.1.
This distinction matters. CVE-2025-22224 provides code execution in the VMX process; it should not be described by itself as complete host takeover. CVE-2025-22225 is the sandbox-escape step described by the advisory. CVE-2025-22226 is an information-disclosure issue, not a code-execution issue.
Broadcom’s current advisory states that it has information suggesting exploitation of all three CVEs has occurred in the wild.
Recommended Remediation Workflow
- Inventory the affected products and exact builds. Include standalone ESXi, VCF-managed hosts, Workstation, Fusion, and applicable Telco products.
- Compare each build with the current advisory. Do not rely only on a scanner’s advisory title; confirm the installed build against the response matrix.
- Plan the supported update path. Check compatibility and product-specific prerequisites. For VCF, use the documented async-patching workflow referenced by Broadcom.
- Protect recoverability. Confirm that current configuration backups and workload recovery plans are usable before changing production infrastructure.
- Evacuate and maintain hosts correctly. For clustered ESXi hosts, migrate or shut down workloads as appropriate and place each host into maintenance mode before applying its supported lifecycle operation.
- Apply the fixed or a later supported build. There is no Broadcom workaround that substitutes for this step.
- Verify the result. Confirm the reported build, cluster health, management connectivity, storage and network health, and workload availability before returning the host to service.
- Continue monitoring. Review security telemetry and incident-response data for activity that predates remediation; applying the fixes blocks these vulnerable code paths but does not prove that earlier exploitation did not occur.
No Workaround Means No Equivalent Configuration Fix
Broadcom lists None in the Workarounds column for CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226. Restricting administrative access inside VMs, segmenting management networks, and monitoring hosts are sensible controls, but they do not remove the vulnerable code and should not be presented as equivalent remediation.
Historical Context
My original March 2025 article described the initial urgency correctly but incorrectly stated that patches were not yet available. Broadcom’s initial advisory already included fixed versions. I have corrected the original article and retained it as historical context, while this page provides the current remediation-first guidance.