CVE-2025-22247

Published May 12, 2025

Last updated 17 days ago

VMware Tools

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-22247 is a vulnerability in VMware Tools that stems from insecure file handling. A malicious actor with non-administrative privileges within a guest virtual machine can exploit this vulnerability to tamper with local files. This tampering can then trigger insecure file operations within the VM. This vulnerability, also known as ShadowWrite, allows low-privilege users inside a virtual machine to silently modify files, potentially influencing privileged operations or altering system behavior without detection. It affects VMware Tools versions 11.x and 12.x on Windows and Linux. There are currently no workarounds available, with patching being the recommended security measure. VMware has released version 12.5.2 to address the vulnerability.

Description: VMware Tools contains an insecure file handling vulnerability. A malicious actor with non-administrative privileges on a guest VM may tamper the local files to trigger insecure file operations within that VM.
Source: security@vmware.com
NVD status: Deferred

Risk scores

CVSS 3.1

Type: Secondary
Base score: 6.1
Impact score: 4.2
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Severity: MEDIUM

Weaknesses

security@vmware.com: CWE-59

Hype score: Not currently trending

References

Sources include official advisories and independent security research.