BROADCOM has issued security updates for VMware Workstation and VMware Fusion, addressing two vulnerabilities, including a critical flaw that could allow arbitrary code execution. The primary issue, tracked as CVE-2026-59346 (CVSS 9.3), is an integer-overflow vulnerability that a local attacker with elevated privileges inside a virtual machine could exploit to run code on the host, provided the attacker already has access with local administrative rights on the VM.
A second flaw, CVE-2026-59347 (CVSS 8.1), is a stack-based buffer overflow in HGFS that could let a local administrator execute code as the VMX process on the host. The discoveries credit researchers from Tencent Xuanwu Lab for reporting the latter.
The affected products are VMware Workstation and VMware Fusion versions 25H2 and 26H1. Broadcom notes there are no workarounds, and patches are available in VMware Workstation 26H1u1 and VMware Fusion 26H1u1. Exploitation requires the attacker to already hold local administrative privileges within a VM, a state that could be reached via phishing or weak user configurations.
While there is no public evidence of active exploitation in the wild for these two flaws, VMware vulnerabilities have historically drawn attacker interest, and last month’s activity linked to CVE-2026-59309 and CVE-2026-59310 demonstrates the ongoing risk environment. The report highlights the importance of timely patching given the privilege escalation risk from VM to host. Dated 5 September 2026.