BROADCOM has issued a patch for two VMware Workstation and Fusion vulnerabilities that could let an attacker inside a guest virtual machine run code on the host. The flaws affect VMXNET3, VMware’s virtual NIC, and HGFS, the Host-Guest File System. One flaw is an integer-overflow rated CVE-2026-59346 with a CVSS score of 9.3, while the other is a stack-based buffer overflow tracked as CVE-2026-59347 with a CVSS score of 8.1.
In both cases, exploitation requires the attacker to already hold local administrative privileges inside the guest VM, and there are no available workarounds.
The issues impact VMware Workstation and VMware Fusion versions 25H2 and 26H1, with VMware confirming fixes in version 26H1u1. Security researchers from teams including h4urek and secsys lab with Y², and Tencent Xuanwu Lab, reported the flaws to Broadcom. Broadcom’s advisory states that a malicious actor with local admin rights on a VM could execute code on the host via VMXNET3 or HGFS, underlining the importance of updating promptly. Users running affected products on Windows, Linux (Workstation) or macOS (Fusion) should upgrade to 26H1u1 as a matter of urgency.