VMware Workstation and Fusion Updates Fix Critical VM Escape

Broadcom has published security updates for a critical VMware Workstation vulnerability that can let an attacker with administrative rights inside a virtual machine run code on the physical computer that hosts it. The flaw, tracked as CVE-2026-59346, carries a CVSS score of 9.3 out of 10. It is an integer overflow, a programming error where a value exceeds the space set aside to store it, which can let an attacker influence the software in unintended ways. The vulnerability is reached through the VMXNET3 virtual network adapter, the virtual network card used by the guest, and it only matters when an attacker already has local administrative privileges inside the guest virtual machine.

The same update also fixes CVE-2026-59347, which has a CVSS score of 8.1. This second flaw is a stack-based buffer overflow in HGFS, the shared folders feature that lets files move between a virtual machine and its host. A stack-based buffer overflow is a memory safety bug in which too much data is written into a fixed-size storage area, and it can be abused to redirect what the software does next. With local administrative access inside the guest, an attacker could exploit this issue to execute code as the VMX process running on the host. The VMX process is the component on the host computer that manages a virtual machine's core operations, so compromising it breaks the isolation boundary between the guest and the rest of the machine.

Broadcom credited @h4urek, @cameudis, and Stan S for reporting the integer overflow, and Yeonghyeon Choi and Tianchu Chen of Tencent Xuanwu Lab for reporting the HGFS buffer overflow. The affected versions are VMware Workstation and VMware Fusion 25H2 and 26H1. Broadcom says there are no workarounds for either vulnerability, and both are fixed in VMware Workstation 26H1u1 and VMware Fusion 26H1u1. Anyone using an earlier version should apply the update before starting a virtual machine.

Successful exploitation depends on an attacker already having local administrative privileges inside a virtual machine. That access is not something the flaws can create on their own, but it can be obtained through a separate compromise such as a phishing message or weak user configuration. Broadcom states that there is no evidence that either flaw has been exploited in the wild so far. However, VMware products remain a frequent target because they sit between the operating system and the virtual machines, and a successful escape can undermine the security of everything running on the same host.

The update arrives against a backdrop of other VMware attacks. Last month, threat actors were observed actively exploiting two separate vulnerabilities in VMware vCenter, a central management platform for VMware infrastructure, CVE-2026-59309 and CVE-2026-59310, with the second suspected to have been weaponized by an advanced persistent threat (APT) actor, a well-resourced group that quietly breaks into systems and stays for long periods, with links to China. According to the source, that activity started five calendar days after public disclosure and is estimated to have reached 361 unique victim IP addresses across 47 countries. The highest number of infections was seen in Germany (55), followed by the United States (41), Turkey (38), Iran (26), and France (25).

For website owners and IT teams, the lessons are straightforward. Virtual machines are often used to test software, run legacy systems, or isolate risky activities, but they only provide real separation if the host and hypervisor, the underlying software that creates and manages virtual machines, are kept patched. Applying the VMware Workstation 26H1u1 and VMware Fusion 26H1u1 updates closes the two newly disclosed escape paths. Teams that routinely patch virtualization infrastructure reduce the chance that a minor account compromise inside a test VM can become a serious breach of the host machine. For IT groups that run VMware Workstation or Fusion in lab or development environments, AEU-I's security-first IT and consulting practice can help keep patching and host hardening on a regular review cycle.