VMware Workstation EUVD-2026-94169

Exploitation requires the attacker to already hold local administrative privileges inside a guest VM running on an affected build of VMware Workstation or Fusion (25H2 or 26H1), and requires the HGFS feature (Host-Guest File System, used for shared folders between host and guest) to be reachable from the guest. Limiting factors that reduce realistic risk: the attacker must first fully compromise a guest to admin level (local, pre-authenticated foothold required), the CVSS AC:H indicates exploitation of the stack overflow is non-trivial and must overcome host memory protections, and the issue is remediated by updating to Workstation/Fusion 26H1u1. This makes the flaw most relevant to untrusted-guest or multi-tenant deployments rather than to single-trusted-user desktops.

This is a VMware guest-to-host escape in the HGFS (Host-Guest File System / shared folders) component, which is a genuinely high-value class of flaw because it breaks the primary security boundary of virtualization. The vendor CVSS vector (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, base 8.1) reflects local attack vector, high exploitation complexity, a scope change from guest to host, and full confidentiality/integrity/availability impact on the host. Note an apparent conflict: the vector lists PR:N (no privileges) while the description explicitly requires 'local administrative privileges on a virtual machine' - this is VMware's standard scoring convention, where PR is measured against the vulnerable component's authority (the host VMX process), on which the attacker holds no privileges, even though they must already be admin inside the guest. In practical terms this is NOT a remote-unauthenticated issue: an attacker must already fully control a guest VM. No EPSS score, CISA KEV listing, or POC availability was provided in the input, so there is no signal of active or widespread exploitation; combined with AC:H (buffer-overflow exploitation defeating modern mitigations is non-trivial), this is best treated as a serious-but-not-emergency patch priority. The real risk concentrates in multi-tenant or untrusted-guest scenarios (malware analysis labs, shared desktop virtualization, CI runners) where an attacker plausibly holds guest admin; in single-user developer-desktop deployments the practical exposure is far lower.

An attacker who has already obtained administrative access inside a guest virtual machine (e.g., via malware detonation in an analysis sandbox or a compromised VM) sends specially crafted HGFS requests to the host. These overflow a stack buffer in the VMX process, allowing the attacker to execute arbitrary code with the privileges of the host-side VMX process and escape the VM. No public exploit code was identified at time of analysis, and the high attack complexity (AC:H) means reliable exploitation requires defeating host-side memory protections.