VMware Workstation and Fusion Updates Patch Critical Vulnerability
Broadcom patched two critical vulnerabilities in VMware Workstation and Fusion: CVE-2026-59346 (CVSS 9.3, integer overflow) and CVE-2026-59347 (CVSS 8.1, stack-based buffer overflow) Both flaws allow a malicious actor with local admin privileges inside a VM to execute arbitrary code on the host, representing a critical VM escape risk The vulnerabilities affect VMware Workstation and Fusion versions 25H2 and 26H1, with fixes available in version 26H1u1 No workarounds exist; Broadcom strongly reco
Analysis
TL;DR
- Broadcom patched two critical vulnerabilities in VMware Workstation and Fusion: CVE-2026-59346 (CVSS 9.3, integer overflow) and CVE-2026-59347 (CVSS 8.1, stack-based buffer overflow)
- Both flaws allow a malicious actor with local admin privileges inside a VM to execute arbitrary code on the host, representing a critical VM escape risk
- The vulnerabilities affect VMware Workstation and Fusion versions 25H2 and 26H1, with fixes available in version 26H1u1
- No workarounds exist; Broadcom strongly recommends immediate patching, though no active exploitation in the wild has been reported
- VMware has over two dozen vulnerabilities on CISA's Known Exploited Vulnerabilities list, underscoring the sector's ongoing security challenges
Why It Matters
VM escape vulnerabilities are among the most dangerous class of flaws in virtualization, as they allow attackers to pivot from a compromised guest VM to the underlying host system, potentially compromising all workloads on that machine. For AI practitioners running models in virtualized environments, this represents a direct threat to infrastructure security and data confidentiality. The absence of workarounds makes timely patching a critical operational priority.
Technical Details
- CVE-2026-59346 (CVSS 9.3): An integer overflow vulnerability that can be exploited by an attacker with local administrative privileges on a VM equipped with a VMXNET3 virtual network adapter, leading to arbitrary code execution on the host
- CVE-2026-59347 (CVSS 8.1): A stack-based buffer overflow vulnerability allowing a similarly privileged attacker to execute code as the VM's VMX process running on the host, with different exploitation conditions than CVE-2026-59346
- Both vulnerabilities affect VMware Workstation and VMware Fusion versions 25H2 and 26H1; the fix is included in version 26H1u1
- No workarounds are available for either flaw, and Broadcom reports no evidence of in-the-wild exploitation at this time
- The vulnerabilities were reported privately to Broadcom, consistent with responsible disclosure practices
Industry Insight
- Organizations running VMware Workstation or Fusion should prioritize immediate patching to version 26H1u1, as the VM escape nature of these flaws makes them high-value targets for threat actors
- The pattern of VMware vulnerabilities accumulating on CISA's KEV list suggests virtualization platforms remain a persistent attack surface; consider network segmentation and least-privilege access for VMs as defense-in-depth measures
- AI practitioners deploying workloads in virtualized environments should audit their VMware versions and assess whether any VMs with admin-level access could serve as an initial foothold for host compromise
Disclaimer: The above content is generated by AI and is for reference only.