CVE-2026-59346

Summary

The flaw is an integer-overflow vulnerability in VMware Workstation and Fusion, allowing a local attacker with administrative privileges to execute code on the host. This matters because it provides a powerful attack vector for privilege escalation and remote code execution.

Exploitability

Exploitation is relatively straightforward for an attacker with local admin rights on a virtual machine with the VMXNET3 adapter. Precondition is the presence of the VMXNET3 adapter and local admin privileges.

Blast radius

If exploited, the attacker can execute code on the host, potentially leading to full system compromise and data loss.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to VMware Workstation 26H1u1 or later, or VMware Fusion 26H1u1 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.