CVE-2025-22226

VMware virtualization products have an information disclosure vulnerability actively exploited in the wild, potentially allowing memory leakage from privileged virtual machines.

VMware ESXi, Workstation, and Fusion products contain an information disclosure vulnerability due to an out-of-bounds read, allowing attackers with administrative privileges to leak memory. DIB organizations using these products must immediately patch to prevent potential data exposure and compliance violations (NIST 800-171 controls 3.1.1, 3.1.2). Verify patching effectiveness and review virtual machine access controls.

Shame score — A widely-used virtualization platform having an actively exploited information disclosure vulnerability demonstrates a significant security oversight with potential for data compromise.