Broadcom Patches Critical Vulnerability in VMware Workstation and Fusion

Broadcom has released fixes for two vulnerabilities in VMware Workstation and Fusion, one of which is rated critical.

Escaping the virtual machine

The main issue is CVE-2026-59346, with a CVSS score of 9.3. It is an integer overflow vulnerability tied to the VMXNET3 virtual network adapter. According to Broadcom, an attacker with local administrative privileges inside a virtual machine can exploit the flaw to execute code on the host system itself. In other words, this is a break out of the isolation perimeter — one of the most dangerous scenarios for virtualization software. The vulnerability was discovered by researchers @h4urek, @cameudis, and Stan S.

The second flaw, CVE-2026-59347 (CVSS 8.1), is a stack-based buffer overflow in the HGFS component. It allows an attacker with the same local privileges to execute code as the VMX process of the virtual machine on the host. The problem was reported by Yeonghyeon Choi and Tianchu Chen of Tencent Xuanwu Lab.

Exploitation conditions and protection

Both vulnerabilities require the attacker to already have administrative privileges inside the guest system. This considerably narrows the range of scenarios, but such privileges are often obtained separately — through phishing or by exploiting weak user settings — so this barrier should not be regarded as reliable protection.

Affected are VMware Workstation and Fusion versions 25H2 and 26H1. According to Broadcom, there are no workarounds — the issues have been fixed only in the Workstation 26H1u1 and Fusion 26H1u1 updates.

Why this matters

There are no signs yet of the new vulnerabilities being exploited in real-world attacks. Even so, VMware products have traditionally been a magnet for attackers. Just last month there was active exploitation of two holes in VMware vCenter — CVE-2026-59309 and CVE-2026-59310; the latter is linked to an APT group of Chinese origin. The attacks began just five days after the vulnerability was publicly disclosed and, by some estimates, affected 361 unique IP addresses across 47 countries. The most infections were recorded in Germany (55), the United States (41), Turkey (38), Iran (26), and France (25).

Against the backdrop of such statistics, administrators using VMware Workstation and Fusion would do well not to put off installing the updates.

Source: The Hacker News