BROADCOM has released patches for two critical vulnerabilities in VMware Workstation and VMware Fusion, identified as CVE-2026-59346 (CVSS 9.3) and CVE-2026-59347 (CVSS 8.1). The first is described as an integer overflow that could allow an attacker with local administrative privileges on a guest VM to execute code on the host. The second is a stack-based buffer overflow with similar potential outcomes, also requiring local VM privileges, enabling code execution in the VM’s VMX process running on the host. Both flaws affect VMware Workstation and Fusion versions 25H2 and 26H1 and are addressed in version 26H1u1.
Security firm Broadcom notes there are no workarounds for either vulnerability and urges updating to the patched release as soon as possible. The advisory states that neither flaw has been publicly exploited in-vivo at the time of disclosure, with both issues reported to Broadcom privately. Security Week notes that VMware vulnerabilities have historically seen exploitation, and cites ongoing interest in VMware CVEs on the KEV list, underscoring the importance of timely remediation.
Organisations relying on VMware Workstation or Fusion should prioritise upgrading to 26H1u1 to reduce exposure, while remaining vigilant for any new threat reports or exploit activity.