{"id":"CVE-2026-59346","title":"VMware Workstation and Fusion contain an integer-overflow vulnerability","summary":"VMware Workstation and Fusion contain an integer-overflow vulnerability. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host.…","severity":"critical","cvss":9.3,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":["CWE-190"],"vendor":"VMware","product":"VMware Workstation","affected":["workstation >= 25H2 <= 26H1","fusion >= 25H2 <= 26H1"],"published":"2026-10-07","updated":"2026-10-07","sourceUpdated":"2026-10-07T06:16:35.543","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-59346","references":[{"url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/security-advisories/0/38288","label":"security@vmware.com"}],"tags":["nvd","cve.org","exploit-available"],"exploits":{"github":1,"githubRepos":["https://github.com/0xCyberstan/CVE-2026-59346-POC"],"checkedAt":"2026-10-07T08:20:38.257Z"},"exploitAvailable":true,"ingestedAt":"2026-10-07T08:20:03.936Z","slug":"CVE-2026-59346","body":"## Overview\n\nVMware Workstation and Fusion contain an integer-overflow vulnerability. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host.\n\nAffected versions:\n- VMware Workstation: 25H2, 26H1 (fixed in 26H1u1)\n- VMware Fusion: 25H2, 26H1 (fixed in 26H1u1)\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"abyssal","depthScore":63,"depthScoreParts":{"impact":51.2,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[]}