Broadcom patches critical VMware host code execution flaws

Broadcom has released security updates for VMware Workstation and VMware Fusion to address two vulnerabilities that can let an attacker with administrative rights inside a virtual machine execute code on the host. The most severe issue, CVE-2026-59346, carries a CVSS score of 9.3 and affects versions 25H2 and 26H1 of both products.

The flaw is an integer-overflow vulnerability involving the VMXNET3 virtual network adapter. Broadcom said a malicious actor with local administrative privileges on a virtual machine could exploit it to run arbitrary code on the host system. The company credited @h4urek, @cameudis and Stan S with reporting the issue.

Two paths from a guest VM toward the host

Broadcom also patched CVE-2026-59347, a stack-based buffer-overflow vulnerability in HGFS, or the shared-folder component. It has a CVSS score of 8.1. An attacker with local administrative privileges on a VM could use the flaw to execute code as that virtual machine’s VMX process running on the host.

Both vulnerabilities require an attacker to have elevated local privileges in the guest operating system before exploitation. That prerequisite does not remove the risk: such privileges may follow a separate compromise, including phishing or weak user configurations. The vulnerabilities therefore matter to organisations where desktop virtual machines handle sensitive development, testing or operational workloads.

Fixed releases and patching priorities

Broadcom said there are no workarounds for either vulnerability. The fixes are included in VMware Workstation 26H1u1 and VMware Fusion 26H1u1, so administrators should identify installations running the affected 25H2 and 26H1 releases and move them to the updated versions.

There is no evidence that these two flaws have been exploited in the wild. Even so, VMware products remain a frequent target. The urgency is reinforced by critical VMware and enterprise platform fixes because VMware was among the products receiving critical fixes alongside other enterprise platforms.

What security teams should do

Teams should first inventory Workstation and Fusion endpoints, confirm whether VMXNET3 adapters or HGFS shared folders are in use, and apply the relevant 26H1u1 update. They should also review who holds local administrator privileges in guest machines, since that access is required for both attack paths. The practical business implication is that patching must be paired with tighter guest privilege control to reduce the chance that a VM compromise becomes a host compromise.