Broadcom released security updates on Thursday as part of its quarterly advisory for VMware Workstation and Fusion, addressing two critical flaws that could let an attacker with administrative rights execute arbitrary code on the host system. The vulnerabilities affect both Windows and Linux installations and could be leveraged without user interaction.
The first flaw, identified as CVE-2026-59346, is an integer overflow in the VMX component that permits code execution when a malicious actor with local administrative privileges inside a virtual machine. A CVSS score of 9.3 classifies the issue as critical, indicating high impact and ease of exploitation. The second vulnerability, rated high severity, involves a privilege escalation path that could allow a compromised virtual machine to affect the host.
Broadcom’s security advisory, issued Thursday, confirms that the integer overflow resides in the VMX driver and can be triggered by specially crafted instructions. As the quote notes, a malicious actor with local administrative privileges on a virtual machine with VMX can achieve arbitrary code execution. The flaw affects both Windows and Linux hosts, and successful exploitation does not require additional user interaction. Successful exploitation could lead to full system compromise, including data theft or ransomware deployment.
Security researchers have demonstrated proof‑of‑concept code that exploits the overflow, raising concerns that active attacks could emerge. However, no public incidents have been reported, and the vulnerability remains contained until unpatched systems are compromised. Users are urged to apply the latest updates immediately to eliminate the risk. Enterprises should verify that all affected installations have received the patch before the end of the week.
If left unaddressed, the flaw could allow attackers to gain full control of the host operating system, compromising data integrity and potentially spreading malware across corporate networks. Broadcom expects the patches to be rolled out within days, and ongoing monitoring will ensure that any emerging threats are swiftly mitigated.
What is CVE-2026-59346? It is an integer overflow vulnerability in the VMware Workstation and Fusion VMX component. The flaw can be triggered by a malicious actor with local administrative privileges to execute arbitrary code on the host system.
Which VMware products are affected? Both VMware Workstation and VMware Fusion on Windows and Linux platforms are impacted. The integer overflow affects the VMX driver used for virtual machine management.
Do I need to reinstall the software after applying the patch? No, the update is delivered as a standard patch that replaces the vulnerable files. Reinstalling is unnecessary as long as the patch is successfully installed.