PoC Exploit Released for Critical VMware Vulnerability Enabling Guest-to-Host Attacks
Public PoC for CVE-2026-59346 crashes VMware Workstation and Fusion through a guest-to-host integer overflow.
66
Vulnerability1 · 1 read
CVE-2025-41236
- CVSS 3.1
- 9.3 critical
- EPSS
- 2%p84
- Published
- ·
- Modified
Description · NVD
VMware ESXi, Workstation, and Fusion contain an integer-overflow vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Non VMXNET3 virtual adapters are not affected by this issue.
- Weakness
- CWE-787
- Vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
In the news
4 storiesPoC Released for Critical VMware VMXNET3 Flaw Enabling Guest-to-Host Code Execution
Public PoC for VMware CVE-2026-59346 crashes the host VMX process but does not prove code execution.
66
60
60