cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

Broadcom Patches Critical VMware Workstation and Fusion Flaws Enabling Host Code Execution

· Original article ↗

Summary

Broadcom patched two VMware Workstation and Fusion flaws, including a critical integer overflow that could enable host code execution by a local VM administrator. A separate HGFS flaw was also fixed; no in-the-wild exploitation was reported.

Key points

  • CVE-2026-59346 is a critical integer-overflow flaw (CVSS 9.3); a local attacker with administrative privileges on a VM using VMXNET3 could execute code on the host.
  • CVE-2026-59347 is a stack-based buffer overflow in HGFS (CVSS 8.1) that could allow code execution as the VMX process on the host.
  • Both flaws affect VMware Workstation and Fusion versions 25H2 and 26H1; Broadcom says no workarounds are available.
  • The issues are patched in VMware Workstation 26H1u1 and VMware Fusion 26H1u1.
  • The article reports no evidence that these two flaws have been exploited in the wild.
  • Separately, two VMware vCenter flaws, CVE-2026-59309 and CVE-2026-59310, were reportedly exploited, with an estimated 361 victim IP addresses across 47 countries breached.

Article Details

Vulnerability Types
  • Integer overflow
  • Stack-based buffer overflow
Severity
CVE-2026-59346: Critical (CVSS 9.3); CVE-2026-59347: CVSS 8.1
Affected Versions
  • VMware Workstation 25H2
  • VMware Workstation 26H1
  • VMware Fusion 25H2
  • VMware Fusion 26H1
Exploitation Status
not_reported
Exploit Availability
unknown
Patch Status
available

MITRE ATT&CK

T1611 · Escape to HostCVE-2026-59346 and CVE-2026-59347 could allow code execution on the host from a virtual machine.

CVE

CVE-2026-59309It also fixed CVE-2026-59347 in HGFS, while warning that VMware products remain a frequent target after recent exploitation of VMware vCenter flaws CVE-2026-59309 and CVE-2026-59310.CVE-2026-59310It also fixed CVE-2026-59347 in HGFS, while warning that VMware products remain a frequent target after recent exploitation of VMware vCenter flaws CVE-2026-59309 and CVE-2026-59310.CVE-2026-59346Broadcom has patched two VMware Workstation and Fusion vulnerabilities, including CVE-2026-59346, a critical integer-overflow flaw that could let a local attacker with elevated privileges execute code on the host.CVE-2026-59347It also fixed CVE-2026-59347 in HGFS, while warning that VMware products remain a frequent target after recent exploitation of VMware vCenter flaws CVE-2026-59309 and CVE-2026-59310.

People

@cameudisCredited by Broadcom with discovering CVE-2026-59346.@h4urekCredited by Broadcom with discovering CVE-2026-59346.Stan SCredited by Broadcom with discovering CVE-2026-59346.Tianchu ChenAcknowledged for reporting CVE-2026-59347.Yeonghyeon ChoiAcknowledged for reporting CVE-2026-59347.

Vendors

BroadcomBroadcom has patched two VMware Workstation and Fusion vulnerabilities, including CVE-2026-59346, a critical integer-overflow flaw that could let a local attacker with elevated privileges execute code on the host.

Products

VMware FusionThe two vulnerabilities affect VMware Workstation and VMware Fusion versions 25H2 and 26H1.VMware vCenterIt also fixed CVE-2026-59347 in HGFS, while warning that VMware products remain a frequent target after recent exploitation of VMware vCenter flaws CVE-2026-59309 and CVE-2026-59310.VMWare WorkstationBroadcom has patched two VMware Workstation and Fusion vulnerabilities, including CVE-2026-59346, a critical integer-overflow flaw that could let a local attacker with elevated privileges execute code on the host.

Countries

France(41), Turkey (38), Iran (26), and France (25).GermanyMost of the infections were concentrated in Germany (55), the U.S.Iran(41), Turkey (38), Iran (26), and France (25).Turkey(41), Turkey (38), Iran (26), and France (25).United StatesMost of the infections were concentrated in Germany (55), the U.S.

Related Articles