Critical VMware Workstation and Fusion Flaw Lets VM Admins Execute Host Code

Two Flaws, One Escape Path

Broadcom has shipped security updates for VMware Workstation and Fusion fixing two vulnerabilities that let an attacker with only local administrative access inside a virtual machine break out and run code on the underlying host — the scenario virtualization is specifically supposed to prevent.

At a Glance

Affected versions: VMware Workstation and Fusion 25H2 and 26H1.

What's Actually Vulnerable

CVE-2026-59346 is an integer-overflow bug in the VMXNET3 virtual network adapter. Broadcom's advisory states that "a malicious actor with local administrative privileges on a virtual machine with [a] VMXNET3 virtual network adapter may exploit this issue to execute code on the host" — meaning the VM doesn't need any special configuration beyond using the default virtual NIC type many deployments already run.

CVE-2026-59347 is a stack-based buffer overflow in HGFS, the shared-folder mechanism between guest and host. Exploiting it lets an attacker execute code as the VMX process — the host-side process that manages the VM — again requiring only local admin rights inside the guest.

Both bugs share the same prerequisite (local admin inside the VM) and the same consequence (code execution on the host), which is exactly the trust boundary a hypervisor exists to enforce.

Exploitation Status and Fix

Broadcom reports no evidence of active exploitation in the wild for either flaw as of disclosure. That said, VMware desktop hypervisor products are a recurring target for VM-escape research and real-world attacks, and public advisories tend to accelerate reverse-engineering of the patch diff.

There are no workarounds for either vulnerability — the only fix is upgrading:

Who Should Prioritize This

This matters most for environments where VM guests are not fully trusted by the people who administer the host — think shared lab environments, malware analysis sandboxes, CTF/training infrastructure, contractor-provided VMs, or any setup where a guest's local admin isn't the same person controlling the host. In those cases, a guest-to-host escape converts "isolated test VM" into "attacker has a foothold on your workstation or lab host."

Recommended Actions

1. Upgrade to Workstation/Fusion 26H1u1 as soon as practical — there is no mitigating configuration change
2. Treat VMXNET3-backed VMs as higher priority for patching given CVE-2026-59346's lower complexity path
3. Re-evaluate use of HGFS shared folders for untrusted guests until patched, since CVE-2026-59347 rides that same channel
4. Audit who has local admin inside guest VMs in shared or multi-tenant lab environments — that's the exact privilege level both bugs require

Sources

• The Hacker News — Critical VMware Workstation and Fusion Flaw Lets VM Admins Execute Host Code

Related Reading

• Critical Unauthenticated RCE in Hummingbird WordPress Plugin