Description
VMware Workstation and Fusion contain a stack-based buffer-overflow vulnerability in HGFS. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.
Affected versions:
- VMware Workstation: 25H2, 26H1 (fixed in 26H1u1)
- VMware Fusion: 25H2, 26H1 (fixed in 26H1u1)
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| VMware | VMware Workstation | 25H2 – ≤ 26H1 | 26H1u1 |
| VMware | VMware Fusion | 25H2 – ≤ 26H1 | 26H1u1 |
Advisories 1
- WID-SEC-2026-3169 VMware Fusion und Workstation: Mehrere Schwachstellen ermöglichen Codeausführung BSI CERT-Bund (WID) · Oct 7, 2026