CVE-2026-59347

HighCVSS 8.1

Published: 07/10/2026(UTC)Updated: 07/10/2026(UTC)Translated: 07/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

10th percentile - higher than 10% of all known CVEs

Summary

VMware Workstation and Fusion contain a stack-based buffer-overflow vulnerability in HGFS. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. Affected versions: Workstation 25H2, 26H1 (fixed in 26H1u1); Fusion 25H2, 26H1 (fixed in 26H1u1).

Risk Assessment

An attacker with administrative privileges in a virtual machine can execute code on the host, potentially compromising the entire host system.

Recommendation

Update VMware Workstation and Fusion to version 26H1u1 or later to remediate the vulnerability.

Other vulnerabilities in VMware Workstation and Fusion

CVE-2026-59346Critical
VMware Workstation and Fusion contain an integer-overflow vulnerability. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host.

Original NVD description (English source)

VMware Workstation and Fusion contain a stack-based buffer-overflow vulnerability in HGFS. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. Affected versions: - VMware Workstation: 25H2, 26H1 (fixed in 26H1u1) - VMware Fusion: 25H2, 26H1 (fixed in 26H1u1)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS