VMSA-2026-0007: two escapes from a VMware guest, and no configuration that stops them
VMSA-2026-0007: two escapes from a VMware guest, and no configuration that stops them On 3 September 2026 Broadcom published VMSA-2026-0007, an advisory covering two memory-safety defects in VMware Workstation and VMware Fusion. Both allow code to move from a guest virtual machine to the host, and both are fixed only in the 26H1u1 builds. The VMXNET3 integer overflow The first defect is…
On September 3, 2026, Broadcom released security advisories VMSA-2026-0007 detailing two critical memory-safety flaws in VMware Workstation and Fusion. The vulnerabilities, CVE-2026-59346 and CVE-2026-59347, allow code execution from a guest virtual machine to the host operating system.
The first issue, CVE-2026-59346, is a VMXNET3 integer overflow flaw. It enables an attacker with administrative privileges inside a Windows or Linux guest using the VMXNET3 virtual network adapter to send malicious traffic through the virtual NIC, ultimately executing code on the host machine. This gives the attacker access to the host's resources and potentially sensitive data.
The VMXNET3 adapter is the default for Windows and Linux guests in recent versions of Workstation and Fusion, and is enabled by default in many existing virtual machines.
The second problem, CVE-2026-59347, is a stack buffer overflow in VMware's HGFS shared folder file system. An attacker with admin rights can exploit this to execute arbitrary code within the host VMX process, effectively granting them the same privileges as the host user. Shared folders are a common feature, and often remain enabled after initial setup.
Critical to this advisory is Broadcom's claim that no workaround exists. Disabling shared folders or changing the virtual network adapter type does not close the security gaps. The only solution is to upgrade to the 26H1u1 build, the first version containing the fixes.
Affected are Workstation 25H2/26H1 on any host OS, and Fusion 25H2/26H1 on macOS. Both products are fixed only in the 26H1u1 update version. No public exploits are known at this time, but the vulnerabilities could pose serious risks to systems where untrusted code runs with elevated privileges.
For now, the recommended course of action is upgrading to the latest build. Administrators should identify which guests have administrative rights and treat those environments as if they are on the same trust level as the host operating system. The advisory underscores the importance of keeping virtualization environments up to date, and exercising caution when granting administrative privileges within guest VMs.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
