VMware patches critical host-code execution flaw

Broadcom has shipped patches for two security defects in VMware Workstation and Fusion, one carrying a critical severity rating, that could let a virtual machine run code on the underlying host under specific conditions.

The flaws touch the VMXNET3 virtual network adapter and the HGFS shared-folder feature, and they affect the 25H2 and 26H1 release lines of both products, according to the company's advisory.

Integer Overflow in VMXNET3

The more severe issue, tracked as CVE-2026-59346 and rated 9.3 on the CVSS scale, is an integer-overflow bug. An attacker who already holds local administrative privileges inside a virtual machine equipped with a VMXNET3 adapter can exploit it to run arbitrary code on the host machine. Broadcom credited @h4urek, @cameudis, and Stan S for finding the problem.

"A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host," the company's advisory states.

A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host.

— Broadcom security advisory

Stack Overflow in HGFS

The second vulnerability, CVE-2026-59347, is a stack-based buffer-overflow with a CVSS score of 8.1. It is located in HGFS, and a similarly placed attacker can trigger it to execute code as the virtual machine's VMX process, which runs on the host. Tencent Xuanwu Lab researchers Yeonghyeon Choi and Tianchu Chen reported the issue.

In both scenarios, the attacker must already have local administrative privileges inside the guest OS. But Broadcom notes that such access can be acquired through other means, including phishing campaigns or weak user configurations, making the escalation step from guest to host a meaningful leap.

Affected Versions and Patches

The two vulnerabilities affect VMware Workstation and VMware Fusion versions 25H2 and 26H1. Broadcom stated that there are no workarounds that mitigate the issues, and that fixes are contained in VMware Workstation 26H1u1 and VMware Fusion 26H1u1. Administrators are left with updating those editions as the only remedy.

The company's advisory includes the following key details:

• CVE-2026-59346: critical integer overflow in VMXNET3, CVSS 9.3, allows host code execution
• CVE-2026-59347: high-severity stack overflow in HGFS, CVSS 8.1, allows code execution as the VMX process
• Affected: Workstation and Fusion versions 25H2 and 26H1
• Fixed: Workstation 26H1u1 and Fusion 26H1u1

The advisory also notes that the two bugs were found by independent researchers, and while no active exploitation has been confirmed, the company advises applying the updates promptly.

Exploitation Requires Prior Foothold

The precondition of local administrative privileges in the guest means an attacker must first compromise a VM from the inside before attempting to break out to the host. That raises the practical difficulty, but the escalation path is dangerous when achieved, as it lands the attacker on the machine running the hypervisor.

Broadcom's wording leaves no room for mitigation steps short of patching. For environments that run untrusted workloads or rely on VMs to isolate sensitive processes, an unpatched host becomes an attractive target once any guest is penetrated.

VMware Remains a Frequent Target

There is no evidence yet that these two flaws have been exploited in the wild, but Broadcom's alert comes against a backdrop of recent attacks against its products. In the month prior to this disclosure, threat actors were observed exploiting two separate VMware vCenter vulnerabilities, tracked as CVE-2026-59309 and CVE-2026-59310.

The vCenter incidents highlight the pattern. One of those vulnerabilities was suspected to be weaponized by a China-nexus advanced persistent threat actor, and the activity began just five calendar days after the flaw became public knowledge.

Real-World Impact in Recent Attacks

The scale of that earlier campaign was substantial. According to the reporting, the exploitation is estimated to have breached 361 unique victim IP addresses across 47 countries, with the heaviest concentration of infections in Germany (55), the United States (41), Turkey (38), Iran (26), and France (25). Those numbers show how quickly a VMware flaw can be turned into a mass compromise once details are out.

This history informs the risk assessment for the current Workstation and Fusion bugs. Even absent confirmed exploitation, the timeline of prior VMware vulnerabilities suggests that attackers may move quickly to develop exploits once patches are reverse-engineered.

What This Means for Users

For administrators running VMware Workstation or Fusion in sensitive environments, the practical takeaway is to update to version 26H1u1 as soon as possible. The lack of workarounds means that delaying the patch leaves VMs open to a guest-to-host break-in if an attacker manages to get local admin rights in a guest.

The broader pattern across VMware products indicates that hypervisor bugs are increasingly being targeted. Because these flaws sit beneath the operating systems they host, a successful exploit can undermine the isolation that virtualization is supposed to provide. That puts pressure on teams to treat patching of infrastructure software with the same urgency as they do their most exposed internet-facing services.