CVE-2026-59346 – VMware Workstation

VMware has released Workstation and Fusion 26H1u1 to fix two flaws that let an attacker inside a virtual machine run code on the host. Both flaws affect Workstation and Fusion 25H2 and 26H1. CVE-2026-59346 has a CVSS score of 9.3, Critical severity. It is an integer overflow in the VMXNET3 virtual network adapter. CVE-2026-59347 has a CVSS score of 8.1, High severity. It is a stack-based buffer overflow in HGFS that runs attacker code as the VM's VMX process on the host.

Both flaws require local administrative privileges inside a guest VM. Once attackers have that access, they can escape the VM and compromise the host. That breaks the isolation that development, testing, and security teams count on. Update all Workstation and Fusion installations to 26H1u1.