CVE-2026-59347

VMware Workstation and Fusion contain a stack-based buffer overflow (CWE-121) in HGFS, the host-guest shared-folder channel. A malicious actor who already has local administrative privileges inside a guest virtual machine can trigger the flaw and execute code as that VM's VMX process on the host, a guest-to-host breakout. CVSS 3.1 scores it 8.1 (high) with a local vector, high attack complexity, changed scope, and high impact to confidentiality, integrity, and availability. Only Workstation 25H2 and 26H1 and Fusion 25H2 and 26H1 are listed as affected; both products are fixed in 26H1u1. It is not in CISA's Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known.

What to do: Upgrade VMware Workstation and VMware Fusion to 26H1u1 (a 26H1 build that is not the u1 update is still affected). Until hosts are updated, do not run untrusted guests with HGFS shared folders on sensitive machines, and treat guest administrators as able to target the host VMX process.