Vulnerability · Published May 12, 2025 · Assigned by vmware
CVE-2025-22247Insecure file handling vulnerability
Medium 6.1
In plain English
A medium-severity security flaw in VMware Tools. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.3%top 80.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
VMware Tools contains an insecure file handling vulnerability. A malicious actor with non-administrative privileges on a guest VM may tamper the local files to trigger insecure file operations within that VM.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | open-vm-tools | 12.5.0-1.el10.alma.1 | ALSA-2025:A003 |
| AlmaLinux:8 | open-vm-tools | 12.3.5-2.el8.alma.1 | ALSA-2025:A001 |
| AlmaLinux:9 | open-vm-tools | 12.5.0-1.el9.alma.1 | ALSA-2025:A002 |
| AlmaLinux:9 | open-vm-tools | 13.0.0-1.el9_7.1 | ALBA-2025:20841 |
| AlmaLinux:10 | open-vm-tools-desktop | 12.5.0-1.el10.alma.1 | ALSA-2025:A003 |
| AlmaLinux:8 | open-vm-tools-desktop | 12.3.5-2.el8.alma.1 | ALSA-2025:A001 |
| AlmaLinux:9 | open-vm-tools-desktop | 12.5.0-1.el9.alma.1 | ALSA-2025:A002 |
| AlmaLinux:9 | open-vm-tools-desktop | 13.0.0-1.el9_7.1 | ALBA-2025:20841 |
| AlmaLinux:10 | open-vm-tools-devel | 12.5.0-1.el10.alma.1 | ALSA-2025:A003 |
| AlmaLinux:8 | open-vm-tools-devel | 12.3.5-2.el8.alma.1 | ALSA-2025:A001 |
| AlmaLinux:9 | open-vm-tools-devel | 12.5.0-1.el9.alma.1 | ALSA-2025:A002 |
| AlmaLinux:10 | open-vm-tools-salt-minion | 12.5.0-1.el10.alma.1 | ALSA-2025:A003 |
| AlmaLinux:8 | open-vm-tools-salt-minion | 12.3.5-2.el8.alma.1 | ALSA-2025:A001 |
| AlmaLinux:9 | open-vm-tools-salt-minion | 13.0.0-1.el9_7.1 | ALBA-2025:20841 |
| AlmaLinux:9 | open-vm-tools-salt-minion | 12.5.0-1.el9.alma.1 | ALSA-2025:A002 |
| AlmaLinux:10 | open-vm-tools-sdmp | 12.5.0-1.el10.alma.1 | ALSA-2025:A003 |
| AlmaLinux:8 | open-vm-tools-sdmp | 12.3.5-2.el8.alma.1 | ALSA-2025:A001 |
| AlmaLinux:9 | open-vm-tools-sdmp | 12.5.0-1.el9.alma.1 | ALSA-2025:A002 |
| AlmaLinux:9 | open-vm-tools-sdmp | 13.0.0-1.el9_7.1 | ALBA-2025:20841 |
| AlmaLinux:10 | open-vm-tools-test | 12.5.0-1.el10.alma.1 | ALSA-2025:A003 |
| AlmaLinux:8 | open-vm-tools-test | 12.3.5-2.el8.alma.1 | ALSA-2025:A001 |
| AlmaLinux:9 | open-vm-tools-test | 12.5.0-1.el9.alma.1 | ALSA-2025:A002 |
| AlmaLinux:9 | open-vm-tools-test | 13.0.0-1.el9_7.1 | ALBA-2025:20841 |
| Debian:12 | open-vm-tools | 2:12.2.0-1+deb12u3 | DEBIAN-CVE-2025-22247 |
| Debian:12 | open-vm-tools | 2:12.2.0-1+deb12u3 | DSA-5919-1 |
| Debian:13 | open-vm-tools | 2:12.5.0-2 | DEBIAN-CVE-2025-22247 |
| Debian:14 | open-vm-tools | 2:12.5.0-2 | DEBIAN-CVE-2025-22247 |
| Ubuntu:22.04:LTS | open-vm-tools | 2:12.3.5-3~ubuntu0.22.04.2 | USN-7508-1 |
| Ubuntu:22.04:LTS | open-vm-tools | 2:12.3.5-3~ubuntu0.22.04.2 | UBUNTU-CVE-2025-22247 |
| Ubuntu:24.04:LTS | open-vm-tools | 2:12.4.5-1~ubuntu0.24.04.2 | UBUNTU-CVE-2025-22247 |
| Ubuntu:24.04:LTS | open-vm-tools | 2:12.4.5-1~ubuntu0.24.04.2 | USN-7508-1 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | VMware Tools | 12.x.x, 11.x.x – before 12.5.2 |
Weakness: CWE-59 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
References
- https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25683
- http://www.openwall.com/lists/oss-security/2025/05/12/2
- http://www.openwall.com/lists/oss-security/2025/05/13/2
- https://lists.debian.org/debian-lts-announce/2025/05/msg00017.html
- http://www.openwall.com/lists/oss-security/2025/09/24/3
- http://www.openwall.com/lists/oss-security/2025/09/25/3
- http://www.openwall.com/lists/oss-security/2025/09/25/5
- http://www.openwall.com/lists/oss-security/2025/09/26/1