The more serious issue, tracked as CVE-2026-59346 with a CVSS score of 9.3, is an integer-overflow vulnerability. Exploitation requires an attacker to already hold elevated privileges on the guest operating system. If successfully triggered, the flaw permits arbitrary code execution on the host system—effectively allowing a VM administrator to compromise the underlying machine.

• The flaw stems from improper handling of integer operations, leading to memory corruption.
• Successful exploitation grants code execution in the context of the host process.
• No user interaction is required beyond the initial local access.

Broadcom has not indicated that either vulnerability has been exploited in the wild as of the disclosure date.

For administrators running virtualized environments, the patch release underscores the importance of treating guest-level administrative access as a security boundary. Mitigation steps include:

• Updating VMware Workstation and Fusion to the latest patched versions immediately.
• Restricting administrative access to VMs to trusted personnel only.
• Monitoring vendor advisories for additional context on affected build numbers.

Source: The Hacker News

Has your team already begun testing the updated builds, or are you holding off until the broader rollout stabilizes?