VMware patches two guest-to-host escape flaws in Workstation and Fusion

Broadcom published VMSA-2026-0007 covering two memory-safety bugs in VMware Workstation and Fusion: a VMXNET3 integer overflow (CVE-2026-59346, CVSS 9.3) and an HGFS stack buffer overflow (CVE-2026-59347, CVSS 8.1). Both let a guest administrator execute code on the host, and only the 26H1u1 builds fix them; no workaround exists.

• CVE-2026-59346 in VMXNET3 is rated 9.3 on CVSSv3
• CVE-2026-59347 in HGFS is rated 8.1
• Workstation and Fusion 25H2 and 26H1 are affected
• Only 26H1u1 builds fix it; no workaround is available