VMware overflow flaws prompt updates as public PoC only crashes host

Canada urged VMware updates as a public PoC for CVE-2026-59346 crashes the host without proving code execution.

The Canadian Centre for Cyber Security issued advisory AV26-1008 on October 7, 2026, urging updates for VMware Fusion on macOS and VMware Workstation versions before 26H1u1 and directing administrators to Broadcom advisory VMSA-2026-0007. That advisory covers integer-overflow and buffer-overflow flaws CVE-2026-59346 and CVE-2026-59347; the Canadian bulletin does not report active exploitation. On October 8, Cyber Security News and GBHackers reported a public proof of concept for CVE-2026-59346, an integer overflow in VMXNET3 TCP Segmentation Offload processing that can cause an out-of-bounds write in the host vmware-vmx process. Broadcom scores it CVSS 9.3, says exploitation could enable host code execution, and patched Workstation and Fusion in 26H1u1 on September 3, 2026; versions 25H2 and 26H1 are affected, guest administrative access is required, and there is no workaround. Sources disagree on severity and demonstrated impact: ZDI scores the issue 7.5 and says it can support hypervisor code execution, while both outlets say the published proof of concept only crashes vmware-vmx—and, per GBHackers, powers off the guest—without showing code execution. The flaw is tied to incomplete checks for earlier CVE-2025-41236; Cyber Security News names the researcher 0xCyberstan, whereas GBHackers names Stan S and cites ZDI-26-647.