Broadcom has issued patches for two critical vulnerabilities in VMware Workstation and Fusion that could allow an attacker to escape a virtual machine and execute code on the host system. The company confirmed these issues in its VMSA-2026-0007 advisory, noting that no workarounds are available, and users should update to version 26H1u1 immediately.
The first vulnerability, identified as CVE-2026-59346, carries a CVSS score of 9.3, classifying it as critical. This integer-overflow flaw affects the VMXNET3 virtual network adapter, a component designed by VMware for virtual machines. An attacker with local administrative privileges within a virtual machine configured with a VMXNET3 adapter could exploit this vulnerability to execute arbitrary code on the underlying host system. The advisory states that a malicious actor with local administrative privileges on a virtual machine with a VMXNET3 virtual network adapter may exploit this issue to execute code on the host. This flaw was independently reported by researchers h4urek (@h4urek) with secsys lab & Y² (@cameudis), and Stan S, who worked with the TrendAI Zero Day Initiative.
The second vulnerability, CVE-2026-59347, has a CVSS score of 8.1. This is a stack-based buffer overflow located in the Host-Guest File System (HGFS) component. HGFS is a VMware feature that enables a guest virtual machine to access files and directories residing on the physical host. Exploiting this vulnerability would allow an attacker with local administrative privileges on a virtual machine to execute code with the privileges of the VMX process running on the host. The advisory specifies that a malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. This vulnerability was reported to Broadcom by Yeonghyeon Choi and Tianchu Chen of Tencent Xuanwu Lab.
Both vulnerabilities impact VMware Workstation and VMware Fusion versions 25H2 and 26H1. VMware Workstation is designed to run on Windows and Linux operating systems, while VMware Fusion is developed for macOS. The patches for these flaws have been incorporated into version 26H1u1 of both products.
