Critical VMware Workstation and Fusion Flaw Lets VM Admins Execute Host Code
Broadcom patched two critical vulnerabilities in VMware Workstation and Fusion: CVE-2026-59346 (integer overflow, CVSS 9.3) and CVE-2026-59347 (stack-based buffer overflow in HGFS, CVSS 8.1) Both flaws allow a local attacker with elevated VM privileges to escape the virtual machine and execute arbitrary code on the host CVE-2026-59346 specifically targets the VMXNET3 virtual network adapter; CVE-2026-59347 affects the HGFS (Host-Guest File System) Patches are available in VMware Workstation 26H1
Analysis
TL;DR
- Broadcom patched two critical vulnerabilities in VMware Workstation and Fusion: CVE-2026-59346 (integer overflow, CVSS 9.3) and CVE-2026-59347 (stack-based buffer overflow in HGFS, CVSS 8.1)
- Both flaws allow a local attacker with elevated VM privileges to escape the virtual machine and execute arbitrary code on the host
- CVE-2026-59346 specifically targets the VMXNET3 virtual network adapter; CVE-2026-59347 affects the HGFS (Host-Guest File System)
- Patches are available in VMware Workstation 26H1u1 and VMware Fusion 26H1u1, with no alternative workarounds offered
- No evidence of in-the-wild exploitation yet, but VMware products remain a frequent attack target, as seen with recent vCenter exploits
Why It Matters
VMware virtualization escape vulnerabilities represent a high-impact threat because they allow attackers to pivot from a compromised guest VM to the underlying host, effectively breaking the isolation boundary that virtualization is designed to enforce. For organizations running VMware Workstation or Fusion—especially in development, research, or multi-tenant environments—these flaws underscore the critical importance of maintaining strict privilege boundaries and keeping software patched.
Technical Details
- CVE-2026-59346 (CVSS 9.3): An integer-overflow vulnerability in the VMXNET3 virtual network adapter. A local attacker with administrative privileges inside a VM can exploit this to execute arbitrary code on the host machine. Discovered by @h4urek, @cameudis, and Stan S.
- CVE-2026-59347 (CVSS 8.1): A stack-based buffer-overflow vulnerability in HGFS (Host-Guest File System). Exploitation allows a privileged VM user to execute code as the VMX process running on the host. Reported by Yeonghyeon Choi and Tianchu Chen of Tencent Xuanwu Lab.
- Affected versions: VMware Workstation and Fusion versions 25H2 and 26H1.
- Patch versions: VMware Workstation 26H1u1 and VMware Fusion 26H1u1.
- Exploitation prerequisites: Local administrative privileges within the guest VM, which can be obtained through phishing or weak user configurations.
- No workarounds are available; patching is the only mitigation.
Industry Insight
- Organizations using VMware Workstation or Fusion should prioritize immediate patching to 26H1u1, as virtualization escape vulnerabilities in widely deployed products are high-value targets for threat actors.
- The pattern of VMware vulnerabilities being actively exploited shortly after disclosure (as seen with the recent vCenter CVEs) suggests that delay in patching significantly increases exposure risk.
- Security teams should enforce least-privilege policies within VMs and monitor for anomalous host-level activity, since compromised VM admin access could serve as an initial foothold for host takeover.
Disclaimer: The above content is generated by AI and is for reference only.