CVE-2026-59346: Critical VMware Workstation and Fusion Flaw Enables Guest-to-Host Code Execution

Broadcom has addressed CVE-2026-59346, a critical integer-overflow vulnerability affecting VMware Workstation and VMware Fusion. The flaw carries a CVSS score of 9.3 and can allow an attacker with administrative privileges inside a virtual machine to cross the virtualization boundary and execute code on the underlying host.

The issue resides in VMware’s VMXNET3 virtual network adapter implementation. Successful exploitation could turn compromise of an isolated guest operating system into compromise of the system hosting that virtual machine, significantly increasing the potential impact in development, research, testing, and enterprise virtualization environments.

Broadcom released fixes in VMware Workstation 26H1u1 and VMware Fusion 26H1u1. The vulnerability affects the 25H2 and 26H1 branches of both products, and the vendor has not provided a workaround, making patching the primary remediation measure.

Security teams can leverage SOC Prime’s AI-Native Detection Intelligence Platform to strengthen defenses against emerging vulnerability exploitation and accelerate detection engineering. Detection content can be applied across 40+ SIEM, EDR, and Data Lake technologies and enriched with relevant threat context.

Uncoder AI can further help security professionals transform threat intelligence into detection logic, generate hunting queries, validate and refine rules, visualize attack flows, and translate detection content across multiple security platforms.

Contact Sales

CVE-2026-59346 Analysis

CVE-2026-59346 affects VMware Workstation and Fusion installations using vulnerable releases in conjunction with a VM configured with the VMXNET3 virtual network adapter. According to Broadcom, an attacker with local administrative privileges inside such a virtual machine can exploit the flaw to execute code on the host.

The vulnerability is caused by an integer overflow in the VMXNET3 virtual device implementation. TrendAI Zero Day Initiative’s technical advisory provides additional insight into the underlying problem, noting that insufficient validation of attacker-controlled data can cause an integer overflow before a buffer is allocated. The resulting memory corruption can ultimately allow arbitrary code execution in the context of the hypervisor.

VMXNET3 is VMware’s paravirtualized network adapter, designed to provide high-performance networking for virtual machines. Because the vulnerable component crosses the guest-host trust boundary, exploitation is particularly significant: an attacker who already controls a guest environment at a sufficiently privileged level could potentially escape that environment and execute code on the host.

Broadcom assigned the issue a maximum CVSS v3.1 score of 9.3 and classified it as Critical. The vulnerability requires access to the guest rather than direct exploitation over the network, but no additional user interaction is necessary once the attacker has the required level of access.

ZDI describes the flaw more specifically as affecting VMXNET3 TCP Segmentation Offload processing. According to its analysis, improper validation can result in an integer overflow during buffer-size calculation. An attacker able to manipulate the relevant guest-side data structures can leverage this condition to corrupt memory in the virtualization process.

The security impact therefore extends beyond a crash or denial-of-service condition. A successful exploit may cross the virtualization boundary, potentially exposing files, credentials, applications, and other resources available to the host operating system.

A public CVE-2026-59346 PoC has also become available following coordinated disclosure. The published research demonstrates the vulnerable VMXNET3 TSO path from a Linux guest and can trigger a crash of the host-side VMware process. Its availability increases the importance of updating vulnerable systems, although a crash-oriented proof of concept should not automatically be interpreted as evidence of reliable weaponized remote code execution.

Broadcom credited h4urek of secsys lab, Y², and Stan S working with TrendAI Zero Day Initiative for independently reporting the vulnerability. ZDI records show that its report was submitted to the vendor on August 26, 2026, followed by coordinated public disclosure in September.

At the time of writing, there is no confirmed evidence that the vulnerability is being actively exploited in real-world attacks, and it is not listed in CISA’s Known Exploited Vulnerabilities catalog. Nevertheless, availability of public technical research can make vulnerable systems increasingly attractive targets.

For CVE-2026-59346 detection, security teams should monitor VMware hosts for abnormal vmware-vmx crashes or unexpected process behavior correlated with activity originating from privileged guest systems. Suspicious VMXNET3-related instability following unusual network activity should also warrant investigation.

CVE-2026-59346 Mitigation

Broadcom recommends upgrading VMware Workstation and VMware Fusion to version 26H1u1, which resolves the vulnerability. The vendor’s response matrix lists both 25H2 and 26H1 as affected branches and states that no workaround is available.

Organizations should therefore prioritize patch deployment on systems where users run untrusted, externally sourced, or potentially compromised virtual machines. Development workstations, malware-analysis environments, research systems, and other endpoints where guest operating systems routinely process untrusted content deserve particular attention.

Because exploitation requires elevated control inside the guest, organizations should also reduce the likelihood that an attacker can obtain administrative or root privileges within virtual machines. Applying security updates to guest operating systems, restricting administrative accounts, using least privilege, and protecting privileged credentials can reduce the opportunities available for reaching the vulnerable VMXNET3 code path.

Where operational requirements permit, security teams can review whether individual virtual machines need VMXNET3 networking until patching is complete. However, Broadcom has not published an official workaround, so configuration changes should not be considered a substitute for installing the fixed VMware release.

To Detect CVE-2026-59346 exploitation, defenders can correlate privileged activity within VMware guests with host-side crashes, abnormal hypervisor processes, unexpected child-process execution, or other evidence that activity has crossed from a VM into the host environment.

Organizations should also monitor newly published exploitation research and behavioral indicators as security researchers continue analyzing the flaw. There are currently no vendor-published, attack-specific CVE-2026-59346 IOCs because no confirmed in-the-wild campaign has been attributed to the vulnerability.

SOC Prime’s AI-Native Detection Intelligence Platform can help security teams accelerate threat hunting and detection engineering around emerging vulnerability exploitation while adapting detection logic to their specific telemetry and security stack.