Researcher Released VMware Exploit Proof of Concept
A critical integer overflow in virtual network adapters enables guest-to-host system crashes.
Updated on Oct. 8, 2026 in Cybersecurity
Live Poll
Do you prioritize installing manual software security updates as soon as they become available?
Security researcher 0xCyberstan has released a proof of concept on GitHub for CVE-2026-59346, a critical integer overflow vulnerability in VMware virtual network hardware. The flaw, which affects VMware Workstation and Fusion 25H2 and 26H1, can be triggered to crash the vmware-vmx host process.
Why it matters
The vulnerability poses a significant risk to virtualized environments because it allows an attacker with administrative access inside a guest virtual machine to compromise the host. Broadcom has already released patches to address the flaw, which occurs within the TCP Segmentation Offload processing path.
The flaw stems from a 32-bit integer overflow during memory allocation within the VMXNET3 adapter's TCP Segmentation Offload path. Broadcom assigns the vulnerability a CVSSv3 severity score of 9.3, contrasting with the Zero Day Initiative's rating of 7.5.
The players
Broadcom
A global semiconductor and infrastructure software company that maintains the VMware virtualization suite.
Zero Day Initiative
A security research program that incentivizes and publishes findings on previously unknown software vulnerabilities.
0xCyberstan
The independent security researcher who authored and released the proof of concept exploit code.
The details
The vulnerability is triggered when a 32-bit multiplication of the network segment count and the required memory space overflows, leading to improper memory allocation. The released proof of concept operates as a Linux kernel module that bypasses standard guest driver handling by writing transmit descriptors directly. This exploit causes a segmentation fault that forces the vmware-vmx host process to shut down, effectively powering off the affected virtual machine.
Timeline
September 3, 2026: Broadcom released patches for Workstation and Fusion.
September 9, 2026: The Zero Day Initiative published its advisory.
October 8, 2026: The article was published.
The Tech Race
The discrepancy between the two organizations' scores highlights the subjective assessment of exploitability in virtualized environments under the CVSSv3 vulnerability scoring system. This incident underscores the ongoing challenge of securing hypervisor-level network hardware against guest-side administrative exploits.
Users of VMware Workstation and Fusion 25H2 and 26H1 must update their software immediately, as no workarounds are available to mitigate this flaw. Because the exploit requires administrative access within a guest virtual machine, organizations should prioritize patching environments where untrusted guests operate.
The takeaway
This vulnerability serves as a reminder that virtual network adapters remain a high-value target for guest-to-host privilege escalation. Security teams should audit their virtual infrastructure for the affected 25H2 and 26H1 versions and ensure all systems are updated to at least the September 3, 2026 patch release.
Further reading
For more information on securing virtualized environments, visit Cybersecurity.
Live Poll
Do you prioritize installing manual software security updates as soon as they become available?
