VMware Workstation/Fusion HGFS Stack BOverflow VMX Code Exec
CVE-2026-59347 Published on October 7, 2026
VMware Workstation and Fusion HGFS stack-based buffer-overflow vulnerability
VMware Workstation and Fusion contain a stack-based buffer-overflow vulnerability in HGFS. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.
Affected versions:
- VMware Workstation: 25H2, 26H1 (fixed in 26H1u1)
- VMware Fusion: 25H2, 26H1 (fixed in 26H1u1)
Vulnerability Analysis
CVE-2026-59347 can be exploited with local system access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Type
What is a Stack Overflow Vulnerability?
A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
CVE-2026-59347 has been classified to as a Stack Overflow vulnerability or weakness.
Products Associated with CVE-2026-59347
stack.watch emails you whenever new vulnerabilities are published in VMware Workstation or VMware Fusion. Just hit a watch button to start following.
Affected Versions
VMware Workstation:- Version 25H2, <= 26H1 is affected.
- Version 26H1u1 is unaffected.
- Version 25H2, <= 26H1 is affected.
- Version 26H1u1 is unaffected.