Host code execution via VMXNET3 TSO overflow
Published Oct 7, 2026 · Updated Oct 7, 2026
Integer overflow in VMware Workstation and Fusion 25H2 and 26H1 allows guest OS users to execute code on the host via VMXNET3. The virtual adapter's TSO path multiplies a guest-controlled segment count and segment size in 32 bits, then writes segments into a buffer allocated from the wrapped result. Exploitation requires administrative control of a VM with a VMXNET3 adapter; a published trigger demonstrates a host VMX-process crash, while Broadcom reports host code execution.
Summary
What happened
Integer overflow in VMware Workstation and Fusion 25H2 and 26H1 allows guest OS users to execute code on the host via VMXNET3. The virtual adapter's TSO path multiplies a guest-controlled segment count and segment size in 32 bits, then writes segments into a buffer allocated from the wrapped result. Exploitation requires administrative control of a VM with a VMXNET3 adapter; a published trigger demonstrates a host VMX-process crash, while Broadcom reports host code execution.
The record
- CVE
- CVE-2026-59346
- Published
- Oct 7, 2026
- Updated
- Oct 7, 2026
- Vendor
- Spring
- Product
- VMware Workstation
- Classifications
- CWE-190, T1611
- Attack vector
- local
- Privileges
- admin
Timeline
How it unfolded
- Oct 7, 2026CVE publishedPublication date reported by the CVE source.
- Oct 7, 2026Record updatedLatest update available in the CVE record.
Exploitability
Present is not the same as exploitable
Compare your product and version with the public record. A matching version still requires validation against your environment.
Is a vulnerable build present?
Compare these published version ranges with your installed build and any vendor patches.
- Affected versionversion=25H2 <=26H1
What conditions does exploitation require?
What is affected?
Published CVSS scores
CVSS describes severity. EPSS estimates exploitation probability.
Attacks
What attackers are doing with it
Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.
Activity data is delayed. The latest report is Sep 28, 2026.
Public exploit references
- VMXNET3 TSO integer-overflow crash proof of conceptproof of concept · demonstrated
Labels summarize the accepted research assessment. They do not indicate a test against your environment.
Technologies
Your stack
See the directory against your own environment.
Your stack
Check the software in your environment
Get started to see how Hinoki identifies affected software and validates exploitability in your environment.
Get started