CVE-2026-59346: VMware Workstation and Fusion VMXNET3 integer-overflow vulnerability
VMware Workstation and Fusion contain an integer-overflow vulnerability. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host.
Affected versions: - VMware Workstation: 25H2, 26H1 (fixed in 26H1u1) - VMware Fusion: 25H2, 26H1 (fixed in 26H1u1)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
VMware Fusion and VMware Workstationto a version that resolves this vulnerability.Fixed in 26H1u1
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Hosts running VMware Workstation or VMware Fusion versions 25H2 or 26H1 are affected when a virtual machine uses a VMXNET3 virtual network adapter. Exploitation requires a malicious actor to have local administrative privileges inside that virtual machine.
What is the impact of successful exploitation?
A successful exploit can allow code execution on the host system from the affected virtual machine.
Which releases contain the fix?
VMware Workstation 26H1u1 and VMware Fusion 26H1u1 contain the fix. The listed affected releases are 25H2 and 26H1 for both products.