Description

VMware Workstation and Fusion contain an integer-overflow vulnerability. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Affected versions: - VMware Workstation: 25H2, 26H1 (fixed in 26H1u1) - VMware Fusion: 25H2, 26H1 (fixed in 26H1u1)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-10-07T06:16:35.543Z",
  "pubdate": "2026-10-07T06:16:35.543Z",
  "executiveSummary": "VMware Workstation and Fusion are affected by an integer-overflow vulnerability within the VMXNET3 virtual network adapter implementation.\nThis vulnerability allows an attacker possessing local administrative privileges on a virtual machine to achieve code execution on the host operating system.\nThe flaw stems from improper handling of integer operations, which can lead to memory corruption when processed by the host-side VMXNET3 component.\nSuccessful exploitation requires the attacker to have administrative access within the guest virtual machine, making this a guest-to-host breakout vector.\nThe impact is critical, as it enables unauthorized code execution on the host, potentially leading to full host system compromise, data exfiltration, or persistence.\nAffected products include VMware Workstation and VMware Fusion versions 25H2 and 26H1, necessitating immediate updates to the patched release, version 26H1u1.",
  "technicalDetails": "The vulnerability is identified as an integer-overflow residing within the VMXNET3 virtual network adapter driver. The VMXNET3 device acts as the paravirtualized network interface controller provided by VMware to guests, facilitating high-performance network communication between the virtual machine and the host hypervisor.\nThe root cause involves an arithmetic operation performed during the processing of network packets or device configuration structures within the host-side emulation of the VMXNET3 device. When the virtual machine performs specific I/O operations or transmits malformed packets, the host-side driver may experience an integer overflow. This overflow typically occurs when calculating buffer sizes or memory offsets, resulting in an undersized allocation or an out-of-bounds write operation.\nThe exploitation flow begins with the attacker gaining administrative privileges inside the guest virtual machine. With these privileges, the attacker interacts directly with the VMXNET3 virtual hardware interface. By sending carefully crafted input—such as malformed network packets or specifically formatted device commands—the attacker triggers the vulnerable arithmetic operation in the host hypervisor process.\nOnce the integer overflow is triggered, the subsequent memory operation results in a heap buffer overflow or an out-of-bounds write within the context of the host's virtual machine monitor (VMM) process. Because the VMM process operates with the privileges of the user running the VMware Workstation or Fusion application, the attacker can leverage this memory corruption to overwrite critical data structures, such as function pointers or return addresses.\nBy hijacking the control flow of the host-side process, the attacker can redirect execution to an arbitrary payload (shellcode) injected into the host memory. This grants the attacker execution capabilities on the host operating system, effectively breaking the isolation boundary between the guest and the host. The exploitation allows for the execution of arbitrary code, which carries significant post-exploitation implications, including host-level persistent access, lateral movement within the host environment, and complete bypass of guest security controls. The vulnerability specifically affects VMware Workstation and Fusion versions 25H2 and 26H1, with remediation confirmed in version 26H1u1."
}