PoC Released for Critical VMware VMXNET3 Flaw Enabling Guest-to-Host Code Execution
Public PoC for VMware CVE-2026-59346 crashes the host VMX process but does not prove code execution.
Researcher 0xCyberstan released a proof of concept for CVE-2026-59346, a critical integer overflow in VMware VMXNET3 TCP Segmentation Offload processing inside the host vmware-vmx process. Broadcom rates it CVSS 9.3 and patched VMware Workstation and Fusion in 26H1u1 on September 3, 2026; versions 25H2 and 26H1 are affected, with no workaround. The guest module requires administrative privileges and produces an out-of-bounds write that crashes the host process rather than demonstrating code execution. ZDI rates the issue 7.5 and says it can support hypervisor code execution; the bug follows incomplete checks for earlier CVE-2025-41236.
- CVE-2026-59346 is an integer overflow in the VMXNET3 TSO path.
- Broadcom scores it 9.3; the Zero Day Initiative scores it 7.5.
- The public PoC crashes vmware-vmx but does not show code execution.
- Guest administrative access is required; it is not a remote unauthenticated attack.
- Workstation and Fusion 26H1u1 fixes it, and no workaround is available.
- Organizations
- Zero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-41236 | VMware ESXi, Workstation, and Fusion contain an integer-overflow vulnerability in the VMXNET3 virtual network adapter | 9.3 | 2% | ||
| CVE-2026-59346 | VMXNET3 integer overflow in VMware Workstation and Fusion | 9.3 | <1% | PoC |
From the original article
2 min read at cybersecuritynews.com
A public proof of concept is now available for CVE-2026-59346, a critical integer overflow flaw in VMware’s VMXNET3 virtual network adapter, released by 0xCyberstan. The flaw can allow an attacker with administrative access inside a guest virtual machine to execute code on the host. However, the published PoC shows a host process crash, not a […]
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.