Critical Vulnerabilities Patched in VMware Workstation and Fusion Allowing Host Code Execution
Broadcom has disclosed two vulnerabilities in VMware Workstation and VMware Fusion rated as critical and important respectively. CVE-2026-59346 is an integer overflow flaw in the VMXNET3 virtual network adapter that can be exploited by a local administrator inside a virtual machine to execute arbitrary code on the host system, carrying a CVSS v3.1 base score of 9.3. CVE-2026-59347 is a stack-based buffer overflow in the HGFS file system that permits code execution on the host as the VMX process with a CVSS score of 8.1. Both issues were privately reported and affect users who run virtual machines with local administrative privileges. The flaws have been addressed in VMware Workstation 26H1u1 and VMware Fusion 26H1u1, and Broadcom urges immediate updates via advisory VMSA-2026-0007.
Security NEXTSep 4, 2026Translated from Japanese