CVE-2026-59347: VMware Workstation and Fusion HGFS stack-based buffer-overflow vulnerability

Published Oct 7, 2026

Updated

VMware Workstation and Fusion contain a stack-based buffer-overflow vulnerability in HGFS. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.

Affected versions: - VMware Workstation: 25H2, 26H1 (fixed in 26H1u1) - VMware Fusion: 25H2, 26H1 (fixed in 26H1u1)

Affected Software

2 affected components

VMware Workstation=25H2, =26H1

VMware Fusion=25H2, =26H1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade VMware Fusion to a version that resolves this vulnerability.
Fixed in 26H1u1
Upgrade
Upgrade VMware Workstation to a version that resolves this vulnerability.
Fixed in 26H1u1

Event History

Oct 7, 2026

CVE Published

via MITRE·05:40 AM

Data Sourced

via MITRE·05:40 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this vulnerability?

Hosts running VMware Workstation or VMware Fusion versions 25H2 or 26H1 are affected. Exploitation targets the HGFS component and can result in code execution in the VMX process on the host.

What access does an attacker need to exploit it?

The attacker must have local administrative privileges inside a virtual machine. The provided information does not describe a remote or unauthenticated exploitation path.

What is the remediation?

Update VMware Workstation or VMware Fusion to version 26H1u1, which fixes the issue. The data provided does not specify mitigations for systems that cannot be updated immediately.