VMware Workstation and Fusion Updates Patch Critical Vulnerability

Broadcom disclosed two critical vulnerabilities in VMware Workstation and Fusion: CVE-2026-59346, an integer overflow leading to arbitrary code execution with a CVSS score of 9.3, exploitable by a malicious actor with local administrative privileges on a VM using the VMXNET3 virtual network adapter; and CVE-2026-59347, a stack-based buffer overflow with a CVSS score of 8.1, exploitable by a local admin on a VM to execute code as the VMX process on the host. Both affect VMware Workstation and Fusion versions 25H2 and 26H1 and were resolved in version 26H1u1. No workarounds are available, and no active exploitation has been reported.

Successful exploitation allows an attacker with administrative privileges inside a virtual machine to execute arbitrary code on the host system, potentially compromising the host environment. This elevates the risk of host takeover from a compromised VM, posing a critical security risk.

Broadcom has released patches in VMware Workstation and Fusion version 26H1u1 that address these vulnerabilities. There are no workarounds available. It is strongly recommended to update affected VMware products to version 26H1u1 as soon as possible to mitigate these critical vulnerabilities.