VMware patches guest-to-host bugs as vCenter fires burn
Broadcom patched two VMware Workstation and Fusion flaws on day one of this development, fixing CVE-2026-59346 and CVE-2026-59347 in 26H1u1 for the 25H2 and 26H1 lines. Both bugs let a local administrator inside a virtual machine push execution onto the host side of VMware’s code.
One issue is an integer overflow in VMXNET3 virtual networking; the other is a stack-based buffer overflow in HGFS, the shared-folder path. In both cases, the guest stops being a hard boundary once an attacker already has admin inside it, so the host process that services the VM can be made to run attacker-controlled code.
The larger VMware lesson is that the estate is being hit from two directions at once: these Workstation and Fusion bugs are unexploited, while separate vCenter flaws, CVE-2026-59309 and CVE-2026-59310, are already under active attack by a China-nexus APT. If your environment spans desktop hypervisors and centralized management, the exposure is now family-level, not product-by-product.
VMware Workstation VMXNET3 TSO Segmentation Integer Overflow Local Privilege Escalation Vulnerability Vulnerability Details This vulnerability allows local attackers to escalate privileges on affected installations of VMware Workstation.