Broadcom VMSA-2026-0007 (3 September 2026, Critical) patches two privately reported host-escape-class bugs in VMware Workstation and VMware Fusion 25H2 and 26H1. CVE-2026-59346 is a VMXNET3 integer overflow (CVSSv3 up to 9.3) where a malicious actor with local administrative privileges inside a guest that uses the VMXNET3 virtual NIC may execute code on the host. CVE-2026-59347 is an HGFS stack-based buffer overflow (CVSSv3 up to 8.1) that can let a guest admin run code as the VMX process on the host.

Fixed in Workstation and Fusion 26H1u1. No workarounds.

Update 8 October: researcher 0xCyberstan published proof-of-concept code for CVE-2026-59346 on GitHub. It runs as a Linux kernel module inside a guest with a VMXNET3 adapter and writes transmit descriptors directly, so a 32-bit multiplication in the host's TCP segmentation offload path wraps, the buffer is undersized and guest data is written past it.

The published code crashes the vmware-vmx process and powers off the VM; it is not a working code-execution exploit, and it needs admin rights inside the guest. The researcher ties it to the same code path patched for CVE-2025-41236.

Broadcom does not report in-the-wild exploitation. These are desktop hypervisor bugs, not ESXi/vSphere advisories.