Broadcom VMware security advisory (AV26-1008)
Canada's Cyber Centre urges updates for VMware Workstation and Fusion overflow flaws.
The Canadian Centre for Cyber Security issued advisory AV26-1008 on October 7, 2026, for VMware Fusion on macOS and VMware Workstation versions before 26H1u1. Broadcom advisory VMSA-2026-0007 covers integer-overflow and buffer-overflow flaws CVE-2026-59346 and CVE-2026-59347. The centre urges administrators to review VMware's guidance and apply available updates. The bulletin does not say the flaws are being exploited.
- AV26-1008 covers Fusion and Workstation versions before 26H1u1.
- VMSA-2026-0007 addresses CVE-2026-59346 and CVE-2026-59347.
- The flaws are an integer overflow and a buffer overflow.
- The alert does not report active exploitation.
- Products
- VMware FusionVMware Workstation
- Organizations
- Canadian Centre for Cyber Security
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-59346 | VMXNET3 integer overflow in VMware Workstation and Fusion | 9.3 | <1% | PoC | |
| CVE-2026-59347 | HGFS stack buffer overflow in VMware Workstation and Fusion | 8.1 | — |
From the original article
1 min read at cyber.gc.ca
Serial number: AV26-1008 Date: October 7, 2026 As of October 7, 2026, VMware is affected by vulnerabilities in the following products: VMware Fusion MacOS Prior to 26H1u1 VMware Workstation Prior to 26H1u1 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.