Summary
- Broadcom has issued a critical advisory covering CVE-2026-59346 and CVE-2026-59347 in VMware Workstation and Fusion.
- Both flaws can allow code execution beyond the guest virtual machine under specified local-privilege conditions.
- Workstation and Fusion 25H2 and 26H1 are affected, with version 26H1u1 providing the fixes and no workaround available.
Broadcom has issued a critical VMware security advisory for two vulnerabilities that can allow code execution to cross from a guest virtual machine into the host operating environment.
The flaws affect VMware Workstation and VMware Fusion 25H2 and 26H1. Broadcom has fixed both issues in version 26H1u1 and says there are no workarounds, making the software update the remediation path.
The more severe issue, CVE-2026-59346, is an integer-overflow vulnerability in the VMXNET3 virtual network adapter. Broadcom assigned it a maximum CVSS v3 score of 9.3 and says a malicious actor with local administrative privileges inside a virtual machine using VMXNET3 may be able to execute code on the host.
The second vulnerability, CVE-2026-59347, is a stack buffer overflow affecting VMware’s Host-Guest File System functionality. It has a maximum CVSS v3 score of 8.1. An attacker with local administrative privileges in the guest may be able to execute code as the virtual machine’s VMX process on the host.
Both vulnerabilities therefore require a meaningful foothold inside the guest environment. They are not described as vulnerabilities allowing an unauthenticated internet user to compromise a VMware host directly.
The security boundary involved is nevertheless important. Virtualisation is designed in part to isolate workloads from the system hosting them. A flaw that allows code to move beyond that boundary can turn administrative compromise of a guest into a wider host-level problem.
That distinction is particularly relevant where virtual machines are used to separate development environments, security research, untrusted applications, or other workloads from the main desktop. The value of that isolation depends on the hypervisor and its virtual devices enforcing the boundary correctly even when the guest itself cannot be trusted.
NHS England’s National Cyber Security Operations Centre issued a UK alert on the vulnerabilities on 3 September, describing the potential for arbitrary code execution on a host from an affected virtual machine. Its alert assigns its own threat severity of Medium, while Broadcom rates the underlying security advisory Critical.
The apparently different labels are not necessarily contradictory. Product vulnerability severity describes the technical impact and exploit conditions of the flaws, while operational alerting systems can incorporate other factors when assigning an overall threat level.
Broadcom says both vulnerabilities were privately reported. Its advisory does not provide a workaround and directs users to the fixed 26H1u1 release for both Workstation and Fusion.
There is no indication in the cited advisories that the vulnerabilities are being exploited in the wild. That leaves the immediate issue as patch management rather than incident response, but the potential guest-to-host impact raises the priority for systems where virtual machines are explicitly relied upon as a security boundary.
The fixes also reinforce a longstanding architectural point in desktop virtualisation: compromise inside a guest should not automatically be treated as contained. Virtual hardware, shared filesystems, networking components, clipboard functions, and other host integrations increase usability, but they also form part of the attack surface separating a virtual machine from the underlying system.
