Broadcom patched two security flaws in VMware Workstation and Fusion that expose virtualization administrators to remote and local code execution risks. The most severe vulnerability, CVE-2026-59346, carries a critical CVSS score of 9.3 and stems from an integer-overflow condition in the hypervisor's memory handling routines.
An attacker with local access and elevated privileges on the host system can trigger the integer overflow to corrupt memory allocation structures within the virtual machine monitor. This corrupted state allows arbitrary code execution with hypervisor-level permissions, effectively breaking the isolation boundary that separates guest operating systems from the host. For organizations running Workstation on developer machines or Fusion on Mac-based engineering workstations, this represents a direct path to full system compromise.
The vulnerability requires the attacker to already possess elevated privileges on the host machine. This constraint eliminates opportunistic exploitation from unprivileged remote users, but does not diminish the risk. System administrators, DevOps engineers, and developers running VMs on their own machines often operate with administrative rights by default. Malware running with user-level permissions can escalate to administrator status through secondary exploits, then trigger CVE-2026-59346 to break out of any VM sandbox.
The second flaw remains less documented in initial disclosures, though Broadcom's advisory indicates it also impacts both Workstation and Fusion across Windows, Linux, and macOS platforms. The company recommends immediate patching for all affected versions.
VMware Workstation Pro and Player versions 17.x and earlier require updates. Fusion versions prior to 13.5 need patching. Users should verify their current version number and cross-reference Broadcom's security advisory to confirm patch availability for their specific installation.
Organizations should treat this vulnerability with urgency for several reasons. Development teams frequently use Workstation and Fusion to test untrusted code, malware samples, and experimental software. If threat actors achieve code execution at the hypervisor level, they gain unrestricted access to the host machine, all running virtual machines simultaneously, and potentially the wider network the host connects to. An attacker inside a sandbox escapes with complete visibility into development systems, source code repositories, and credentials stored on the developer machine.
The integer-overflow class of vulnerability has historically proven difficult to exploit reliably across different system configurations and memory layouts. However, active exploit code published after patch release often refines exploitation techniques rapidly. Delaying updates increases the window during which an attacker with privileged access can weaponize this flaw.
Broadcom recommends organizations audit which systems run Workstation and Fusion in their environment, prioritize updates for machines handling sensitive development work or malware research, and enforce the principle of least privilege to reduce the likelihood that compromised user accounts possess the elevated permissions required to exploit CVE-2026-59346.