Broadcom on Thursday announced patches for two critical and high-severity vulnerabilities in VMware Workstation and Fusion.
The first issue, tracked as CVE-2026-59346 (CVSS score of 9.3), is described as an integer overflow bug leading to arbitrary code execution.
“A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host,” Broadcom notes in its advisory.
Tracked as CVE-2026-59347 (CVSS score of 8.1), the second flaw is a stack-based buffer overflow that could lead to similar outcomes, albeit the exploitation conditions are different.
“A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine’s VMX process running on the host,” Broadcom explains.
Both vulnerabilities affect VMware Workstation and VMware Fusion versions 25H2 and 26H1 and were resolved in version 26H1u1.
There are no workarounds for either of the flaws, and Broadcom recommends updating to a patched iteration as soon as possible.
The company makes no mention of any of these vulnerabilities being exploited in the wild, and says that both issues were reported to it privately.
However, security defects in VMware products are often exploited by threat actors. More than two dozen VMware vulnerabilities are currently included in CISA’s KEV list.
Related: CISA Urges Immediate Patching of Exploited Microsoft, VMware, Apple Vulnerabilities
Related: Exploit Published for Fresh Cleo Harmony Vulnerability
Related: SonicWall Warns of Two SMA1000 Zero-Days Exploited in Attacks
Related: Hackers Start Exploiting Critical Langflow Vulnerability
