Full Report
Broadcom has released security updates for two security flaws impacting VMware Workstation and Fusion, including one critical bug that could result in arbitrary code execution under certain conditions. The vulnerability, tracked as CVE-2026-59346 (CVSS score: 9.3), is an integer-overflow vulnerability that a local attacker with elevated privileges can exploit to run arbitrary code. "A
Analysis Summary
# Vulnerability: Critical Code Execution in VMware Workstation and Fusion
## CVE Details
- **CVE ID:** CVE-2026-59346 (Primary focus), CVE-2026-59347
- **CVSS Score:** 9.3 (Critical) for CVE-2026-59346; 8.1 (High) for CVE-2026-59347
- **CWE:** Integer-overflow (CVE-2026-59346); Stack-based buffer-overflow (CVE-2026-59347)
## Affected Systems
- **Products:** VMware Workstation and VMware Fusion
- **Versions:** 25H2 and 26H1
- **Configurations:**
- For CVE-2026-59346: Virtual machines utilizing the **VMXNET3** virtual network adapter.
- For CVE-2026-59347: Systems utilizing **HGFS** (Host Guest File System).
## Vulnerability Description
CVE-2026-59346 is an integer-overflow vulnerability within the VMXNET3 virtual network adapter. An attacker with administrative access on a guest VM can trigger this overflow to break out of the virtualized environment and execute arbitrary code on the underlying host operating system.
CVE-2026-59347 is a stack-based buffer-overflow within the HGFS component. This allows a local administrator on a guest VM to execute code within the context of the virtual machine's VMX process running on the host.
## Exploitation
- **Status:** Not exploited (No evidence of active exploitation in the wild as of the report date).
- **Complexity:** Medium (Requires existing administrative privileges on the guest VM).
- **Attack Vector:** Local (Attacker must already have access to the guest system).
## Impact
- **Confidentiality:** High (Potential full access to host data).
- **Integrity:** High (Arbitrary code execution on the host).
- **Availability:** High (Potential to crash or take control of the host machine).
## Remediation
### Patches
Broadcom has released the following security updates:
- **VMware Workstation:** Update to version **26H1u1**
- **VMware Fusion:** Update to version **26H1u1**
### Workarounds
- **No workarounds available:** Broadcom stated there are no official workarounds to mitigate these specific flaws; patching is the only solution.
## Detection
- **Indicators of Compromise:** Unusual activity originating from the VMX process or unexpected network traffic patterns related to VMXNET3 drivers.
- **Detection methods and tools:** Audit guest VM privilege levels to ensure only trusted users have administrative access. Monitor host-level process integrity for the VMware Workstation/Fusion executable.
## References
- **Vendor Advisory:** hxxps[://]support[.]broadcom[.]com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38288
- **Source Article:** hxxps[://]thehackernews[.]com/2026/09/critical-vmware-workstation-and-fusion.html