A moderate severity vulnerability in VMware Tools could allow attackers with limited privileges to manipulate files and cause unsafe operations within virtual machines.
See also: Vulnerabilities fixed in Ivanti, VMware, Zoom products
The vulnerability, identified as CVE-2025-22247, affects VMware Tools versions 11.xx and 12.xx for Windows and Linux, while macOS versions are confirmed to be unaffected. Given that there are currently no workarounds available and that exploiting the vulnerability could compromise the integrity of affected virtual machines, it is recommended that you apply updates immediately.
According to Broadcom's announcement, the vulnerability is related to insecure handling and allows "a malicious user with non-administrative privileges on a virtual machine to manipulate local files to enable unsafe file operations within the virtual machine itself."
The vulnerability has received a CVSSv3 baseline score of 6.1, placing it in the moderate severity category. Security researcher Sergey Bliznyuk from Positive Technologies has been credited for discovering and reporting the vulnerability to VMware.
See also: Authentication bypass vulnerability in VMware Windows Tools
This particular security issue joins a number of other VMware vulnerabilities addressed earlier in the year, such as the critical TOCTOU (CVE-2025-22224), which affects VMware ESXi and Workstation and can lead to out-of-memory writes and potentially arbitrary code execution.
This type of vulnerability is of particular concern in virtualization environments, where multiple users or organizations share the same physical infrastructure.
Although the impact is limited within the user's virtual machine, the vulnerability can be exploited as part of a larger attack chain or to gain elevated privileges within the virtual machine itself.
See also: Over 37,000 VMware ESXi servers vulnerable to attacks
Broadcom has released VMware Tools version 12.5.2 to fix the vulnerability on Windows and Linux systems. Specifically for 32-bit Windows systems , VMware Tools version 12.4.7 — which is included in the 12.5.2 release — addresses the issue.
Source: cybersecuritynews
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
