VMware Workstation and Fusion: Stack-based buffer overflow in HGFS
Summary
VMware Workstation and Fusion contain a stack-based buffer overflow in the HGFS shared-folder component. An attacker with local administrative privileges inside a virtual machine can execute code as that VM's VMX process on the host. Exploitation requires guest administrator rights and cannot be started remotely; CISA SSVC lists exploitation as none.
Affected
- VMware Workstation 25H2 and 26H1
- VMware Fusion 25H2 and 26H1
Fixed in
- VMware Workstation: 26H1u1
- VMware Fusion: 26H1u1
Workaround
- No vendor workaround (the advisory lists 'None').
- Our recommendation, not a vendor fix: disable HGFS shared folders where they are not needed and limit administrator rights inside guest VMs until 26H1u1 is installed.
Exploitation
- No exploitation in the wild known in the sources reviewed (as of late September 2026).
- No public proof-of-concept found in our searches; this is not proof that none exists.
- CISA SSVC: exploitation none, automatable no.
Our recommendation
- Install VMware Workstation or Fusion 26H1u1 on all affected hosts and verify the build in the About dialog.
- Until patched, disable HGFS shared folders where not needed and restrict guest administrator rights, especially on shared or CI hosts with several VMs.
- Prioritise multi-user and developer hosts; single-user machines without shared folders have lower priority.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Broadcom VMSA-2026-0007 security advisory support.broadcom.com
- OpenCVE: CVE-2026-59347 app.opencve.io
- Security Affairs: Broadcom patches critical VMware Workstation and Fusion flaws securityaffairs.com
- HOL Guard: CVE-2026-59347 hol.org
- Strix: CVE-2026-59347 www.strix.ai
- CCB Belgium: VMware Workstation and Fusion overflow vulnerabilities ccb.belgium.be
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 20:36.
Original description (NVD)
VMware Workstation and Fusion contain a stack-based buffer-overflow vulnerability in HGFS. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. Affected versions: - VMware Workstation: 25H2, 26H1 (fixed in 26H1u1) - VMware Fusion: 25H2, 26H1 (fixed in 26H1u1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.