Broadcom has released urgent patches for two significant vulnerabilities in VMware Workstation and Fusion that could allow attackers to execute arbitrary code on the host system from a compromised virtual machine. These issues, identified as critical and high-severity, underscore the persistent risk in virtualization environments, particularly concerning VM escape scenarios. While there is no current evidence of in-the-wild exploitation, the severity of these flaws warrants immediate attention from security professionals.
Technical Details of VMware Workstation and Fusion Vulnerabilities
The update addresses two distinct vulnerabilities, both posing a significant threat of arbitrary code execution on the host machine:
- CVE-2026-59346: Integer Overflow Leading to Arbitrary Code Execution. This vulnerability carries a CVSS score of 9.3, indicating critical severity. It is described as an integer overflow bug affecting the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges within a virtual machine could exploit this flaw to execute code directly on the host operating system. This represents a dangerous VM escape, allowing an attacker to break out of the virtualized environment’s isolation.
- CVE-2026-59347: Stack-Based Buffer Overflow for Host Code Execution. With a CVSS score of 8.1, this high-severity vulnerability is a stack-based buffer overflow. Similar to CVE-2026-59346, it enables arbitrary code execution on the host. However, its exploitation conditions differ, allowing an attacker with local administrative privileges on a virtual machine to execute code as the virtual machine’s VMX process running on the host. This still bypasses the intended isolation between the guest and host.
Both vulnerabilities affect VMware Workstation and VMware Fusion versions 25H2 and 26H1. Broadcom has resolved these issues in version 26H1u1, as detailed in their advisory. No workarounds are available for either flaw, making patching the only effective remediation strategy, according to SecurityWeek.
Why These Vulnerabilities Matter: VM-to-Host Escalation
The ability to execute code on the host from a guest virtual machine is one of the most serious security concerns in virtualization. While both vulnerabilities require local administrative privileges on the virtual machine, this prerequisite does not diminish their importance. In many enterprise environments, development, testing, or even production VMs might be accessible to various users, or could themselves be compromised through other means. Once a VM is breached, a successful VM escape allows attackers to gain control over the underlying host system, impacting all other VMs running on it, potentially leading to widespread network compromise.
Understanding CVE-2026-59346 exploitation patterns and the broader context of virtualization security is crucial. VMware products are frequently targeted by threat actors due to their widespread deployment and the significant impact of successful exploitation. The presence of numerous VMware vulnerabilities on CISA’s Known Exploited Vulnerabilities (KEV) catalog highlights the attractiveness of these platforms to adversaries, even if these specific CVEs are not yet listed there.
Mitigating Arbitrary Code Execution in VMware Workstation and Fusion
Given the severity and the absence of workarounds, immediate action is paramount for administrators utilizing VMware Workstation and Fusion products. The primary recommendation is to update all affected instances without delay.
Actionable Recommendations:
- Patch Immediately: All installations of VMware Workstation and VMware Fusion versions 25H2 and 26H1 must be updated to version 26H1u1. This is the only method to address these vulnerabilities effectively. Implement this update as part of your urgent patch management cycle.
- Isolate and Segment: Review your network architecture to ensure that virtual machines are appropriately segmented. While patching is the immediate solution, strong network segmentation can limit an attacker’s lateral movement capabilities even if a VM compromise were to occur.
- Principle of Least Privilege: Strictly enforce the principle of least privilege within all virtual machines. Restrict administrative access to VMs to only essential personnel and processes. This reduces the attack surface for vulnerabilities requiring local administrative privileges.
- Monitor for Anomalous Activity: Implement and continuously monitor for unusual activity originating from virtual machines, especially any attempts to interact with the host operating system outside of expected parameters. This includes monitoring VMX processes and network adapter activity for signs of compromise related to CVE-2026-59347 and other potential exploits.
Adhering to comprehensive VMware Workstation and Fusion patching guidance, coupled with strong security hygiene, is essential to protect virtualization infrastructure from these and similar threats.
Related: CVE-2026-64561: Zapscape KVM Flaw Allows Guest VM Escape, VMware Critical Flaws: Auth Bypass, RCE, VM Escapes Patched