# CVE-2026-59346: VMware Workstation and Fusion integer overflow in VMXNET3

Source: https://junglewise.ai/threats/cve-2026-59346-vmware-workstation-and-fusion-contain-an-integer-overflow  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-07. Updated: 2026-10-07  
License: CC BY 4.0 with a link back

CVE-2026-59346 · Severity: critical · CVSS 9.3 · Published 2026-10-07

VMware Workstation and Fusion are virtualization platforms that run virtual machines on host computers. An integer overflow flaw in the VMXNET3 virtual network adapter allows a local administrative user within a guest virtual machine to execute arbitrary code on the host system, potentially compromising the entire hypervisor and other guests running on it.

Technologies: [VMware Fusion](https://junglewise.ai/threats/technologies/fusion), [VMware Workstation](https://junglewise.ai/threats/technologies/workstation). Vendors: [VMware](https://junglewise.ai/threats/vendors/vmware).

## Quick answers

**Is CVE-2026-59346 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59346 being exploited in the wild.

**How severe is CVE-2026-59346?** Critical severity, with a CVSS score of 9.3, published 7 October 2026.

**Which products and versions are affected?** VMware Fusion 25H2, 26H1; VMware Workstation 25H2, 26H1.

**Is there a fix for CVE-2026-59346?** Yes: fixed in VMware Workstation 26H1u1; VMware Fusion 26H1u1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59346 attacked?** It is attacked with local access, in a web application.

**Am I affected by CVE-2026-59346?** Check whether you run VMware Fusion or VMware Workstation at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in VMware Workstation 26H1u1; VMware Fusion 26H1u1

## Technical details

An integer-overflow vulnerability in the VMXNET3 virtual network adapter component of VMware Workstation and Fusion allows guest-to-host code execution. The attack requires local administrative privileges on the virtual machine and network access to the VMXNET3 adapter. A successful exploit grants the attacker arbitrary code execution on the host system, breaking the isolation boundary between guest and host.

## Affected products

- VMware Workstation 25H2, 26H1
- VMware Fusion 25H2, 26H1

## Timeline

- 2026-09-03: advisory: VMSA-2026-0007 published
- 2026-10-07: disclosed: Publicly disclosed

## References

- [https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/security-advisories/0/38288](https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/security-advisories/0/38288)

## Related threats

- [VMware Workstation and Fusion stack buffer overflow in HGFS](https://junglewise.ai/threats/cve-2026-59347-vmware-workstation-and-fusion-contain-a-stack-based-buffer)
- [VMware ESXi, Workstation, and Fusion out-of-bounds read](https://junglewise.ai/threats/cve-2026-41703-vmware-esxi-workstation-and-fusion-out-of-bounds-read)
- [VMware Fusion privilege escalation via TOCTOU in SETUID binary](https://junglewise.ai/threats/cve-2026-41702-vmware-fusion-privilege-escalation-via-toctou-in-setuid-binary)
- [VMware ESXi and Workstation TOCTOU Race Condition Vulnerability](https://junglewise.ai/threats/cve-2025-22224-vmware-esxi-and-workstation-toctou-race-condition-vulnerability)
- [VMware ESXi, Workstation, and Fusion Information Disclosure Vulnerability](https://junglewise.ai/threats/cve-2025-22226-vmware-esxi-workstation-and-fusion-information-disclosure)