VMware Workstation VM escape: get to 26H1u1

If your team runs a VM on a laptop to open something they do not trust, that habit just got a hole in it. Broadcom shipped an advisory this week for CVE-2026-59346, a CVSS 9.3 integer overflow in VMware's VMXNET3 virtual network adapter that lets an attacker with local administrator rights inside a guest execute code on the host machine. VMware Workstation and Fusion 25H2 and 26H1 are affected. There is no workaround. The fix is 26H1u1.

What actually happened

Two flaws, one update. Per SecurityWeek's write-up of the Broadcom advisory:

• CVE-2026-59346 — integer overflow in the VMXNET3 virtual NIC, CVSS 9.3. Local admin in a guest with a VMXNET3 adapter attached gets arbitrary code execution on the host. VMXNET3 is the default paravirtualized adapter, so this is not an exotic configuration.
• CVE-2026-59347 — stack-based buffer overflow, CVSS 8.1. Same prerequisite, narrower landing: code runs as the VM's VMX process on the host rather than fully unconstrained.

Affected builds are Workstation 25H2 and 26H1 on any host OS, and Fusion 25H2 and 26H1 on macOS. Both are fixed in 26H1u1, and Broadcom lists no mitigations — you patch or you carry the risk. Reporting on the advisory credits h4urek of secsys lab, with a separate report from Y² and Stan S through Trend Micro's Zero Day Initiative.

Why a desktop hypervisor matters for your business

The "prerequisite" reads reassuring and is not. Local administrator inside a VM is the starting state for most of the reasons people run one. You spun up a Windows VM to test an installer. A contractor got a throwaway box with admin so they could work. Somebody detonated a suspicious attachment on purpose, in a VM, because that is the advice everyone gives. Every one of those hands an attacker exactly the position CVE-2026-59346 asks for.

Two concrete moves.

Stop treating a desktop VM as a malware sandbox. Workstation and Fusion are convenience products, not isolation products. If you genuinely need to run untrusted code, run it on hardware you can wipe, or in a disposable cloud instance with no path back to your network. A VM escape on a developer laptop lands on the machine holding your SSH keys and your signed-in browser sessions.

Inventory desktop hypervisors like servers. This is the real gap. Workstation and Fusion get installed by individual engineers, updated on their own schedule, and never appear on the patch report your MSP sends you. Nothing in a server-focused vulnerability feed will tell you that three laptops are running 25H2. Find them, get them to 26H1u1, and put the product on the same list as everything else you track — the same discipline we argued for on ScreenConnect.

Sources: Broadcom security advisory, SecurityWeek, The Hacker News.