PoC Exploit Released for Critical VMware Vulnerability Enabling Guest-to-Host Attacks
Public PoC for CVE-2026-59346 crashes VMware Workstation and Fusion through a guest-to-host integer overflow.
A public proof-of-concept was released for CVE-2026-59346, a CVSS 9.3 integer overflow in VMXNET3 TCP Segmentation Offload processing in VMware Workstation and Fusion. A guest attacker with administrative privileges can wrap a 32-bit allocation calculation and cause an out-of-bounds write in the host vmware-vmx process. Researcher Stan S’s Linux kernel-module PoC, tracked by ZDI as ZDI-26-647, crashes the host process and powers off the guest but does not attempt code execution; Broadcom says exploitation could enable host code execution. Affected 25H2 and 26H1 releases are fixed in version 26H1u1, with no workaround. The issue follows incomplete checks added for CVE-2025-41236.
- CVE-2026-59346 is a CVSS 9.3 integer overflow in VMXNET3 TSO handling.
- A privileged guest can cause an out-of-bounds write in host vmware-vmx.
- Published Linux kernel-module PoC crashes the host process but does not execute code.
- Workstation and Fusion 25H2 and 26H1 are affected; 26H1u1 is fixed.
- Flaw follows an incomplete patch for earlier issue CVE-2025-41236.
- Organizations
- Trend MicroZero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-41236 | VMware ESXi, Workstation, and Fusion contain an integer-overflow vulnerability in the VMXNET3 virtual network adapter | 9.3 | 2% | ||
| CVE-2026-59346 | VMXNET3 integer overflow in VMware Workstation and Fusion | 9.3 | <1% | PoC |
From the original article
2 min read at gbhackers.com
A public proof-of-concept (PoC) exploit has been released for CVE-2026-59346, a critical integer overflow flaw in VMware Workstation and Fusion that could enable a privileged attacker inside a virtual machine to execute code on the underlying host. Broadcom has assigned this vulnerability a CVSS v3. 1 score of 9.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.