Broadcom has shipped fixes for a pair of security holes in VMware Workstation and Fusion. One of them is serious enough to let someone escape a virtual machine and run their own code on the physical computer hosting it.

The higher-risk flaw, CVE-2026-59346, carries a CVSS rating of 9.3. It's rooted in an integer-overflow bug and applies specifically to VMs configured with a VMXNET3 virtual network adapter. Per Broadcom's own advisory, anyone with admin-level control inside such a VM could leverage the flaw to break out and execute arbitrary code on the host itself. Three researchers — known online as @h4urek, @cameudis, and Stan S — were acknowledged for surfacing the bug.

A second, somewhat less severe flaw, CVE-2026-59347, scored 8.1 on the CVSS scale. This one's a buffer overflow on the stack, located in HGFS. Like the first bug, it demands that the attacker already hold administrative privileges inside the guest machine — but the payoff is the ability to run code as the host-side VMX process tied to that VM. Credit for this discovery went to Tencent Xuanwu Lab researchers Yeonghyeon Choi and Tianchu Chen.

Neither vulnerability can be triggered by a random unprivileged user — both demand that the attacker first climb to admin status inside the virtual machine. That said, Broadcom points out this isn't much of a barrier in practice, since phishing campaigns or sloppy account setups routinely hand attackers that level of access anyway.

Impacted versions span VMware Workstation and Fusion releases 25H2 and 26H1. Broadcom isn't offering any interim mitigation — organizations need to move straight to Workstation 26H1u1 or Fusion 26H1u1 to close the gap.

So far, there's no sign either bug has actually been used in an attack. Still, VMware's track record makes that cold comfort: just weeks earlier, a threat actor believed to be tied to China was spotted actively abusing two unrelated vCenter vulnerabilities, CVE-2026-59309 and CVE-2026-59310. Investigators tied that operation to breaches at 361 distinct IP addresses across 47 nations in the days following disclosure, with the biggest clusters of victims in Germany, the United States, Turkey, Iran, and France.