Critical VMware VMXNET3 Exploit Released, Enabling Guest-to-Host Code Execution
A proof-of-concept (PoC) exploit has been publicly released for CVE-2026-59346, a critical integer overflow vulnerability in VMware Workstation and Fusion that allows a privileged attacker within a virtual machine (VM) to execute arbitrary code on the underlying host. Assigned a CVSS score of 9.3 by Broadcom, the flaw affects the VMXNET3 virtual network adapter’s TCP Segmentation Offload (TSO) processing in the host’s vmware-vmx process.
The vulnerability stems from a 32-bit integer overflow in the calculation of memory allocation for segmented TCP packets. When a guest VM transmits a large packet via TSO, the host-side backend divides it into smaller segments. However, if the multiplication of segment count and size exceeds the 32-bit limit, the result wraps around, leading to an undersized buffer allocation. Subsequent writes based on the original values cause an out-of-bounds memory corruption in the host process.
Exploitation requires local administrative privileges within the guest VM and a VMXNET3 adapter configuration. Security researcher Stan S published a Linux kernel-module PoC that triggers the flaw by writing crafted descriptors into the VMXNET3 transmit ring, bypassing normal driver validation. While the PoC currently causes a host process crash and VM shutdown, Broadcom’s advisory warns that the vulnerability could be leveraged for full guest-to-host escape, posing a severe risk in environments running untrusted workloads.
The issue follows CVE-2025-41236, a prior VMXNET3 TSO flaw, where incomplete patching left the multiplication check unaddressed. Affected versions include VMware Workstation 25H2/26H1 and Fusion 25H2/26H1, with fixes available in version 26H1u1. Broadcom has not provided a workaround, emphasizing the need for immediate upgrades.
The vulnerability was reported to Broadcom on August 26, 2026, and disclosed by Trend Micro’s Zero Day Initiative (ZDI-26-647) on September 9, 2026. Organizations are advised to restrict guest administrative privileges and assess VMXNET3 necessity for sensitive workloads.
Source: https://gbhackers.com/poc-exploit-released-for-critical-vmware-vulnerability/
VMware cybersecurity rating report: https://www.rankiteo.com/company/vmware
"id": "VMW1791455112",
"linkid": "vmware",
"type": "Vulnerability",
"date": "9/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': 'Organizations using VMware '
'Workstation 25H2/26H1 or Fusion '
'25H2/26H1',
'industry': 'Technology / Virtualization',
'location': 'Global',
'name': 'VMware (Broadcom)',
'size': 'Large',
'type': 'Software Vendor'}],
'attack_vector': 'Local (Guest VM with administrative privileges)',
'customer_advisories': 'Organizations using affected VMware versions are '
'advised to upgrade and review VMXNET3 configurations.',
'date_detected': '2026-08-26',
'date_publicly_disclosed': '2026-09-09',
'description': 'A proof-of-concept (PoC) exploit has been publicly released '
'for CVE-2026-59346, a critical integer overflow vulnerability '
'in VMware Workstation and Fusion that allows a privileged '
'attacker within a virtual machine (VM) to execute arbitrary '
'code on the underlying host. The flaw affects the VMXNET3 '
'virtual network adapter’s TCP Segmentation Offload (TSO) '
'processing in the host’s vmware-vmx process, leading to '
'out-of-bounds memory corruption and potential guest-to-host '
'escape.',
'impact': {'brand_reputation_impact': 'Potential reputational damage due to '
'critical vulnerability disclosure',
'downtime': 'Host process crash and VM shutdown (demonstrated in '
'PoC)',
'operational_impact': 'Potential full guest-to-host escape, risk '
'to untrusted workloads',
'systems_affected': 'VMware Workstation, VMware Fusion (host '
'systems)'},
'investigation_status': 'Publicly disclosed; patch available',
'lessons_learned': 'Incomplete patching of prior vulnerabilities (e.g., '
'CVE-2025-41236) can leave critical flaws unaddressed. '
'Organizations must prioritize timely patching and '
'restrict guest VM privileges to mitigate guest-to-host '
'escape risks.',
'motivation': 'Security Research / Proof-of-Concept',
'post_incident_analysis': {'corrective_actions': 'Patch released to address '
'the integer overflow, with '
'additional hardening '
'measures recommended for '
'guest VM privileges.',
'root_causes': '32-bit integer overflow in VMXNET3 '
'TSO processing due to unchecked '
'multiplication of segment count '
'and size, leading to undersized '
'buffer allocation and '
'out-of-bounds memory corruption.'},
'recommendations': ['Upgrade to VMware Workstation/Fusion 26H1u1 immediately',
'Restrict administrative privileges within guest VMs',
'Assess the necessity of VMXNET3 for sensitive workloads '
'and disable if not required',
'Monitor for further exploit developments and apply '
'compensating controls'],
'references': [{'source': 'Broadcom Advisory'},
{'source': 'Trend Micro’s Zero Day Initiative (ZDI-26-647)'},
{'source': 'Security Researcher Stan S (PoC)'}],
'response': {'communication_strategy': 'Public advisory by Broadcom and Trend '
'Micro’s Zero Day Initiative '
'(ZDI-26-647)',
'containment_measures': 'Immediate upgrade to VMware '
'Workstation/Fusion 26H1u1',
'remediation_measures': 'Patch deployment (version 26H1u1), '
'restrict guest administrative '
'privileges, assess VMXNET3 necessity '
'for sensitive workloads'},
'stakeholder_advisories': 'Broadcom and ZDI advisories recommend immediate '
'patching and privilege restrictions.',
'threat_actor': 'Security researcher Stan S (PoC author)',
'title': 'Critical VMware VMXNET3 Exploit Released, Enabling Guest-to-Host '
'Code Execution',
'type': 'Vulnerability Exploitation',
'vulnerability_exploited': 'CVE-2026-59346 (Integer overflow in VMXNET3 TSO '
'processing)'}