Skip to content
CVE PROGRAM SOURCE RECORD9.3 Critical

CVE-2026-59346

VMware Workstation and Fusion VMXNET3 integer-overflow vulnerability

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
vmware

Description

VMware Workstation and Fusion contain an integer-overflow vulnerability. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Affected versions: - VMware Workstation: 25H2, 26H1 (fixed in 26H1u1) - VMware Fusion: 25H2, 26H1 (fixed in 26H1u1)

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

VMware VMware Workstation

Default version status: unaffected

  • 25H2 to ≤ 26H1affected
  • 26H1u1unaffected

VMware VMware Fusion

Default version status: unaffected

  • 25H2 to ≤ 26H1affected
  • 26H1u1unaffected

References