Broadcom has released security updates for VMware Workstation and VMware Fusion addressing two vulnerabilities that allow an attacker with administrative access inside a virtual machine to break out and execute code on the host computer — the physical machine running the VM software. The more severe flaw, CVE-2026-59346 (CVSS 9.3), is an integer overflow in the VMXNET3 virtual network adapter. A local attacker with VM admin privileges can exploit it to run arbitrary code at the host level. The second flaw, CVE-2026-59347 (CVSS 8.1), is a stack-based buffer overflow in the HGFS shared-folders component; it allows code execution as the VMX process on the host. Broadcom says there are no workarounds — patching is the only remedy.
The required starting position — local admin rights inside a VM — sounds limiting, but it is achievable through phishing or weak VM configurations, making the effective risk higher than the “local only” label implies. Neither vulnerability has been observed exploited in the wild, though VMware products have historically been targeted quickly after patch disclosure. Last month, attackers were observed actively exploiting two VMware vCenter vulnerabilities within five days of public disclosure, compromising over 360 unique IP addresses across 47 countries.
How to check if you’re affected
Affected products include VMware Workstation versions 25H2 and 26H1, and VMware Fusion versions 25H2 and 26H1 on macOS. Both are patched in VMware Workstation 26H1u1 and VMware Fusion 26H1u1. Check your installed version via the application’s Help → About menu, then update to 26H1u1 via Broadcom’s support portal if you are on an earlier build.