Full Report
Broadcom VMware security advisory (AV26-1008)
Analysis Summary
# Vulnerability: Multiple Memory Safety Flaws in VMware Workstation and Fusion
## CVE Details
- **CVE ID:** CVE-2026-59346, CVE-2026-59347
- **CVSS Score:** Not explicitly listed in the brief (Typically High for these classes of vulnerabilities)
- **CWE:** CWE-190 (Integer Overflow), CWE-120 (Buffer Overflow)
## Affected Systems
- **Products:** VMware Fusion (macOS) and VMware Workstation (Windows/Linux)
- **Versions:**
- VMware Fusion: Versions prior to 26H1u1
- VMware Workstation: Versions prior to 26H1u1
- **Configurations:** Standard installations of the desktop hypervisors.
## Vulnerability Description
This advisory addresses two primary memory safety issues:
1. **Integer Overflow:** A flaw where an arithmetic operation results in a value outside the range of the integer type, potentially leading to memory corruption or unexpected program behavior.
2. **Buffer Overflow:** A flaw where the application attempts to write data beyond the boundaries of a fixed-length block of memory.
In the context of VMware Workstation and Fusion, these flaws typically exist in virtualized device drivers or host-guest communication interfaces.
## Exploitation
- **Status:** Not specified as "exploited in the wild" in this bulletin; assume PoC status is internal or private unless updated.
- **Complexity:** Medium (Typically requires specific sequences of guest-to-host calls).
- **Attack Vector:** Local (Exploitation generally occurs from a guest virtual machine to the host system).
## Impact
- **Confidentiality:** High (Potential for memory leakage from the host).
- **Integrity:** High (Potential for unauthorized modification of host memory).
- **Availability:** High (Potential for crashing the host system or the hypervisor process).
## Remediation
### Patches
Broadcom has released the following updated versions to resolve these flaws:
- **VMware Fusion:** Update to version **26H1u1** or later.
- **VMware Workstation:** Update to version **26H1u1** or later.
### Workarounds
- No specific workarounds (such as disabling features) were provided in the summary. The primary recommendation is a full version update.
## Detection
- **Indicators of compromise:** Unusual crashes of the `vmware-vmx` process or unexpected kernel panics on the host machine.
- **Detection methods and tools:** Audit installed software versions across the enterprise using endpoint management tools to identify systems running versions earlier than 26H1u1.
## References
- **Vendor Advisory:** hxxps[://]support[.]broadcom[.]com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38288
- **VMware Security Advisories Main Page:** hxxps[://]support[.]broadcom[.]com/web/ecx/security-advisory
- **Cyber Centre Bulletin:** hxxps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/broadcom-vmware-security-advisory-av26-1008