CyberzSOC

An attacker with access to a virtual machine could escape it to execute code on the host. The vulnerability CVE-2025-22224 , with a CVSS score of 9.3, is a TOCTOU (Time-of-Check Timeof-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine’s VMX process running on the host. The vulnerability CVE-2025-22225 , with a CVSS score of 8.2, is an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may trigger an arbitrary kernel write leading to an escape of the sandbox.