Broadcom Patches Critical VMware Workstation and Fusion VM
Broadcom patched critical VMware Workstation and Fusion VM-escape flaws CVE-2026-59346 (CVSS 9.3) and CVE-2026-59347 (CVSS 8.1); update to 26H1u1.
Advisory VMSA-2026-0007 fixes CVE-2026-59346 (CVSS 9.3), an integer overflow in the VMXNET3 virtual network adapter, and CVE-2026-59347 (CVSS 8.1), a stack-based buffer overflow in HGFS. A malicious actor with local administrative privileges inside a VM could execute code on the host in both cases. The flaws affect Workstation and Fusion 25H2 and 26H1 and are fixed in version 26H1u1 with no workarounds available. The bugs were reported independently by researchers working with Trend Micro Zero Day Initiative and by Tencent Xuanwu Lab.
- CVE-2026-59346: integer overflow in VMXNET3 adapter, CVSS 9.3, allows VM-to-host code execution.
- CVE-2026-59347: stack-based buffer overflow in HGFS, CVSS 8.1, executes code as VMX process.
- No workarounds exist; Workstation and Fusion 25H2/26H1 users must update to 26H1u1.
- Flaws reported independently via Trend Micro Zero Day Initiative and Tencent Xuanwu Lab.
- Products
- VMware WorkstationVMware Fusion
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-59346 | VMXNET3 integer overflow in VMware Workstation and Fusion | 9.3 | <1% | PoC | |
| CVE-2026-59347 | HGFS stack buffer overflow in VMware Workstation and Fusion | 8.1 | — |
From the original article
2 min read at securityaffairs.comBroadcom patched two VMware Workstation/Fusion VM-escape bugs. No workarounds exist. Update to version 26H1u1 immediately.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.