8.1
High
CVE-2026-59347 VMware Workstation and Fusion contain a stack-based buffer-overflow vulnerability in HGFS
Description
VMware Workstation and Fusion contain a stack-based buffer-overflow vulnerability in HGFS. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. Affected versions: - VMware Workstation: 25H2, 26H1 (fixed in 26H1u1) - VMware Fusion: 25H2, 26H1 (fixed in 26H1u1)
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| VMware Workstation 26 | earliest → < 26H1u1 | 26H1u1 |
| VMware Workstation 25 | 25H2 → 26H1 | No fix stated |
| VMware Fusion 26 | earliest → < 26H1u1 | 26H1u1 |
| VMware Fusion 25 | 25H2 → 26H1 | No fix stated |
References
- support.broadcom.com support.broadcom.com
Timeline
- Published
- Last modified
Other CVEs of VMware Workstation
The 7 CVEs of VMware Workstation →
CVE-2026-59346
VMware Workstation and Fusion contain an integer-overflow vulnerability
9.3
Critical
CVE-2020-3959
VMware ESXi (6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG), VMware Workstation (15.x before…
Not rated
CVE-2020-3958
VMware ESXi (6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG), VMware Workstation (15.x before…
Not rated
CVE-2019-5539
VMware Workstation (15.x prior to 15.5.1) and Horizon View Agent (7.10.x prior to 7.10.1 and 7.5.x prior to 7.5.4)…
Not rated