www.it-connect.fr
VMware Workstation and Fusion: Two Flaws Let Attackers Escape a VM to the Host
Do you use VMware Workstation Pro or VMware Fusion? It’s time to patch. Broadcom has just fixed two vulnerabilities, including one critical flaw, that could allow an attacker with control of a virtual machine to run code on the host machine. Here’s what you need to know.
Two vulnerabilities, two different components
The security advisory published by Broadcom on September 3, 2026 concerns VMware’s two desktop hypervisors: VMware Workstation for Windows and Linux, and VMware Fusion for macOS. More specifically, these two flaws affect the following versions: 25H2 and 26H1. I previously covered what’s new in VMware Workstation Pro 26H1 last spring, including the move to a 64-bit application architecture.
These two flaws have one thing in common: they require the attacker to already have administrator privileges inside the virtual machine. With that level of access, the attacker may be able to go further and target the physical host running the VMware solution, using a technique called VM escape.
- CVE-2026-59346. This is an integer overflow in VMXNET3, VMware’s paravirtualized virtual network adapter. It has a CVSS v3 score of 9.3 out of 10. "A malicious actor with local administrative privileges on a virtual machine equipped with a VMXNET3 virtual network adapter may exploit this issue to execute code on the host," Broadcom says.
- CVE-2026-59347. This time, it is a stack-based buffer overflow in HGFS, the component that handles shared folders between the host and the virtual machine. CVSS v3 score for this one: 8.1 out of 10, which is considered high severity. Successful exploitation allows code execution with the privileges of the VM’s VMX process, which runs on the host.
As mentioned earlier, an attacker must be an administrator inside the virtual machine to exploit these vulnerabilities, which reduces the attack surface. However, a prior compromise could allow an attacker to obtain those permissions. And in a lab VM, you are very often an administrator by default... That said, these VMs are generally not running all the time and are more often used on workstations.
In addition, the critical security flaw CVE-2026-59346 reminds me of another issue: the CVE-2026-47876 patched in July 2026 in VMware ESXi. The description is very similar: code execution on the physical host from a VM, VMXNET3 adapter, and so on...
Update to version 26H1u1
Broadcom has fixed both vulnerabilities in VMware Workstation 26H1u1 and VMware Fusion 26H1u1. According to the Workstation Pro 26H1u1 release notes, published the same day, this is build 25688693. If you are using version 25H2, you have no choice but to move to 26H1. Remember that VMware Workstation Pro is free, including for commercial use, and can be downloaded from Broadcom’s support portal.
Finally, this new version also brings a new feature: it includes an automatic remediation mechanism for the VM Secure Boot key, related to Microsoft certificate expiration.
