CVE-2026-59346

VMware Workstation and Fusion contain an integer-overflow vulnerability (CWE-190) in handling of the VMXNET3 virtual network adapter, described in ZDI-26-647 as a TSO segmentation overflow. A malicious actor who already has local administrative privileges inside a guest virtual machine that uses VMXNET3 can trigger the flaw to execute code on the hypervisor host, a guest-to-host breakout rated CVSS 3.1 9.3 (critical) with changed scope and high impact to confidentiality, integrity, and availability. Affected products are Workstation 25H2 and 26H1 and Fusion 25H2 and 26H1. A public proof-of-concept is available, but the issue is not in CISA's Known Exploited Vulnerabilities catalog, so confirmed in-the-wild exploitation is not known from this data.

What to do: Upgrade VMware Workstation and VMware Fusion to 26H1u1, the release that fixes this issue. Until then, do not give untrusted users administrative rights inside guests that use the VMXNET3 adapter, and treat guest-admin access on unpatched 25H2 or 26H1 hosts as a potential path to host compromise.