Reported by 2 outlets
Broadcom VMware security advisory (AV26-1008)
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 1.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.27 / 0.6 · time to second source
- Recency
- × 0.02 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.1 / 10 = base × recency + community
Analysis
Broadcom’s VMware advisory (AV26-1008) covers CVE-2026-59346 (CVSS 9.3, integer overflow) and CVE-2026-59347 (buffer overflow) in VMware Workstation and Fusion for macOS. A public PoC has been released for CVE-2026-59346, allowing a privileged virtual-machine attacker to execute code on the underlying host. Updates address both flaws.
Guest-to-host escapes are high-impact because they break the isolation boundary between virtualized workloads and host systems. Organizations relying on VMware desktop virtualization should apply patches immediately and audit VM access controls, since a compromised guest can escalate directly to host-level control.
Timeline
-
original reporting
Broadcom VMware security advisory (AV26-1008)
malware.news · 6d ago · October 7th, 2026
Serial number: AV26-1008 Date: October 7, 2026 As of October 7, 2026, VMware is affected by vulnerabilities in the following products: VMware Fusion MacOS Prior to 26H1u1 VMware Workstation Prior to 26H1u1 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. VMSA-2026-0007: VMware Workstation and Fusion updates address integer-overflow and buffer overflow vulnerabilities (CVE-2026-59346, CVE-2026-59347) Security Advisories - VMware Cloud Foundation Article Link: Broadcom VMware security advisory (AV26-1008) - Canadian Centre for Cyber Security
-
update from gbhackers.com
PoC Exploit Released for Critical VMware Vulnerability Enabling Guest-to-Host Attacks
gbhackers.com · 5d ago · October 8th, 2026
A public proof-of-concept (PoC) exploit has been released for CVE-2026-59346, a critical integer overflow flaw in VMware Workstation and Fusion that could enable a privileged attacker inside a virtual machine to execute code on the underlying host. Broadcom has assigned this vulnerability a CVSS v3.1 score of 9.3 and has addressed it in VMware Workstation […] The post PoC Exploit Released for Critical VMware Vulnerability Enabling Guest-to-Host Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .