VMware Workstation and Fusion Updates Patch Critical Vulnerability

Broadcom has disclosed two critical vulnerabilities in VMware Workstation and Fusion — an integer overflow (CVE-2026-59346) and a stack-based buffer overflow (CVE-2026-59347) — both of which enable VM-to-host escape attacks when an attacker holds local admin privileges inside a guest machine. Hypervisor escape vulnerabilities are among the most severe class of flaws in virtualized environments because they break the fundamental security boundary between guest and host systems, potentially exposing the entire physical infrastructure. VMware products are historically high-value targets for threat actors, meaning unpatched systems carry elevated real-world risk even before confirmed exploitation is observed. Organizations relying on virtualization for workload isolation must treat these patches as emergency priority, as the security guarantee of VM containment is nullified until remediation is applied.