Vmware Fusion
Monthly
VMware Workstation and Fusion (25H2 and 26H1) carry a stack-based buffer overflow in the HGFS Host-Guest File System component used for shared folders, letting an attacker who already holds administrative privileges inside a guest VM execute code as the VMX process on the host and thereby break the guest-to-host isolation boundary. This is a VMware guest-to-host escape, a genuinely high-value class of flaw because it defeats the primary security boundary of virtualization, though the realities of exploitation are gated: the attacker needs a pre-existing local admin foothold in the guest, HGFS must be reachable, and the CVSS vector's AC:H signals that the overflow must be shaped to bypass host memory protections. Vendor-released patch is available in Workstation/Fusion 26H1u1; no CISA KEV listing and no public exploit code was identified at time of analysis, and no EPSS score was supplied in the source data, so the practical risk concentrates on multi-tenant, untrusted-guest, or shared-lab deployments rather than single-user desktops.
Guest-to-host code execution in VMware Workstation and Fusion 25H2 and 26H1 lets an attacker who already holds local administrative privileges inside a guest VM equipped with the VMXNET3 virtual network adapter escape the hypervisor isolation boundary and run code on the host. The flaw is an integer overflow (CWE-190) in the virtual NIC's device emulation and carries a CVSS 9.3 with Scope:Changed, placing it in the most severe class of hypervisor defects; it is not remotely reachable, since the attacker must first obtain a guest admin foothold and the target guest must use a VMXNET3 adapter. No public exploit code has been identified at time of analysis, and patched builds are available as 26H1u1 for both products.
VMware Workstation and Fusion (25H2 and 26H1) carry a stack-based buffer overflow in the HGFS Host-Guest File System component used for shared folders, letting an attacker who already holds administrative privileges inside a guest VM execute code as the VMX process on the host and thereby break the guest-to-host isolation boundary. This is a VMware guest-to-host escape, a genuinely high-value class of flaw because it defeats the primary security boundary of virtualization, though the realities of exploitation are gated: the attacker needs a pre-existing local admin foothold in the guest, HGFS must be reachable, and the CVSS vector's AC:H signals that the overflow must be shaped to bypass host memory protections. Vendor-released patch is available in Workstation/Fusion 26H1u1; no CISA KEV listing and no public exploit code was identified at time of analysis, and no EPSS score was supplied in the source data, so the practical risk concentrates on multi-tenant, untrusted-guest, or shared-lab deployments rather than single-user desktops.
Guest-to-host code execution in VMware Workstation and Fusion 25H2 and 26H1 lets an attacker who already holds local administrative privileges inside a guest VM equipped with the VMXNET3 virtual network adapter escape the hypervisor isolation boundary and run code on the host. The flaw is an integer overflow (CWE-190) in the virtual NIC's device emulation and carries a CVSS 9.3 with Scope:Changed, placing it in the most severe class of hypervisor defects; it is not remotely reachable, since the attacker must first obtain a guest admin foothold and the target guest must use a VMXNET3 adapter. No public exploit code has been identified at time of analysis, and patched builds are available as 26H1u1 for both products.