6.1

CVE-2025-22247: open-vm-tools Link Following

CVSS: 6.1v3.1MediumDeferred
AliasesMGASA-2025-0166SUSE-SU-2025:01565-1SUSE-SU-2025:01658-1
Published 12-05-2025Last modified 18-11-2025
Open JSON

Vulnerability summary

CVE-2025-22247 is a medium (CVSS 6.1) Link Following vulnerability in open-vm-tools. EPSS estimates a 0.27% chance of exploitation in the next 30 days, higher than 17.5% of scored vulnerabilities.

Overall risk
24/100
0100
Low · default modelHow is this calculated?
CVSS score
6.1/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.27%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 12-05-2025
    PublishedVulnerability first disclosed.
  2. 18-11-2025
    Last modifiedVulnerability information updated.

Description

VMware Tools contains an insecure file handling vulnerability. A malicious actor with non-administrative privileges on a guest VM may tamper the local files to trigger insecure file operations within that VM.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.27%

Chance of exploitation in the next 30 days

Percentile

18%

Versus all other CVEs

30-day change

0.00 pp

From 0.27% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.27%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse14 products
  • open-vm-tools&distro=SUSE Linux Enterprise Micro 5.1< 12.5.2-150300.58.1
  • open-vm-tools&distro=SUSE Linux Enterprise Micro 5.2< 12.5.2-150300.58.1
  • open-vm-tools&distro=SUSE Linux Enterprise Micro 5.3< 12.5.2-150300.58.1
  • open-vm-tools&distro=SUSE Linux Enterprise Micro 5.4< 12.5.2-150300.58.1
  • open-vm-tools&distro=SUSE Linux Enterprise Micro 5.5< 12.5.2-150300.58.1
Redhat10 products
  • open-vm-tools< 0:13.0.0-1.el9_7.1 | < 0:12.3.5-2.el8_10.2
  • open-vm-tools-debuginfo< 0:13.0.0-1.el9_7.1 | < 0:12.3.5-2.el8_10.2
  • open-vm-tools-debugsource< 0:13.0.0-1.el9_7.1 | < 0:12.3.5-2.el8_10.2
  • open-vm-tools-desktop< 0:13.0.0-1.el9_7.1 | < 0:12.3.5-2.el8_10.2
  • open-vm-tools-desktop-debuginfo< 0:13.0.0-1.el9_7.1 | < 0:12.3.5-2.el8_10.2
Opensuse2 products
  • open-vm-tools&distro=openSUSE Leap 15.6< 12.5.2-150600.3.12.1
  • open-vm-tools&distro=openSUSE Tumbleweed< 12.5.2-1.1
Debian1 product
  • open-vm-tools< 2:12.5.0-2 | < 2:12.2.0-1+deb12u3 | < 2:11.2.5-2+deb11u4
Mageia1 product
  • open-vm-tools< 12.3.5-2.1.mga9
Ubuntu1 product
  • open-vm-tools< 2:11.3.0-2ubuntu0~ubuntu20.04.8 | < 2:12.3.5-3~ubuntu0.22.04.2 | < 2:12.4.5-1~ubuntu0.24.04.2 | < 2:10.2.0-3~ubuntu0.16.04.1+esm5 | < 2:11.0.5-4ubuntu0.18.04.3+esm4

6 vendors · 29 products

References

36 links
Show all 36 references