CVE-2026-59346

CriticalCVSS 9.3/10Last modified Oct 7, 2026

Description

VMware Workstation and Fusion contain an integer-overflow vulnerability. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host.

Affected versions: - VMware Workstation: 25H2, 26H1 (fixed in 26H1u1) - VMware Fusion: 25H2, 26H1 (fixed in 26H1u1)

Metrics

CVSS 3.1 9.3/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-190

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 7, 2026
Last modified
Oct 7, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-593478.1VMware Workstation and Fusion contain a stack-based buffer-overflow vulnerability in HGFS. A malicious actor with local administrative priviCVE-2026-59359.8IBM Total Storage Service Console (TSSC) / TS4500 IMC 9.2, 9.3, 9.4, 9.5, 9.6 TSSC/IMC could allow an unauthenticated user to execute arbitrCVE-2026-593548.8In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabCVE-2026-593556.1In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the request_uCVE-2026-593576.5Insufficient verification of data authenticity (CWE-345) in the external OIDC login callback in Cloud Foundry UAA v4.5.0 to v79.6.0 (inclusiCVE-2026-593587.6Improper authentication (CWE-287) in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authenticated attacker holding a valid uCVE-2026-59369.8An attacker can control a server-side HTTP request by supplying a crafted URL, causing the server to initiate requests to arbitrary destinatCVE-2026-59375.5Insufficient parameter verification leads to the occurrence of format errors in files, which will trigger an unhandled "std::invalid_argumenCVE-2026-59385.5Improper control flow management allows a crafted document action chain to cause modal dialog reentry on the main thread, resulting in UI frCVE-2026-59395.5A crafted XFA PDF can trigger a use-after-free condition during calculate event processing, causing the application to crash and resulting iCVE-2026-59405.5Calling a function that triggers a UI refresh after removing comments via a script may access an invalidated object, leading to program crasCVE-2026-59417.1Parsing logic flaws cause non-signature data to be misidentified as valid signatures when processing malformed form field hierarchies, leadi