DEV Community

jeffrey
jeffrey

Posted on

A virtual machine escape is a workstation problem until CI shares the hypervisor

#security #vulnerabilitymanagement

A virtual machine escape is a workstation problem until CI shares the hypervisor

Broadcom published a security advisory on 7 October 2026 covering two defects in VMware Workstation and Fusion: CVE-2026-59346, an integer overflow rated 9.3, and CVE-2026-59347, a stack-based buffer overflow in HGFS rated 8.1.
Affected versions are Workstation 25H2 and 26H1, and Fusion 25H2 and 26H1, both fixed in 26H1u1.
The scoring places the attacker's starting position precisely. Both vectors begin AV:L. CVE-2026-59346 requires a malicious actor with local administrative privileges on a virtual machine using the VMXNET3 virtual network adapter. CVE-2026-59347 requires local administrative privileges on a virtual machine and results in code execution as the VMX process running on the host.

Why a desktop hypervisor bug deserves a corporate patch ticket

The instinct on reading "Workstation and Fusion" is that this concerns a developer's laptop and belongs in a personal-device policy, not in a patch management programme.
Two things push against that. Workstation is used on build servers and test hosts where multiple virtual machines run under a single account. And Fusion on Apple hardware is used by platform teams to run a local mirror of production components, frequently with credentials that reach real systems.
The attacker's prerequisite, local administrative privilege inside the guest, is met in both of those cases by design. A build agent runs as an administrator. A developer's test VM has the credentials the developer uses.
That inversion matters. The advisory describes an attacker who already has administrator inside a VM. In an enterprise build or development context, that is the normal state rather than the compromised state, so the boundary being tested is the one between the guest and the host.

What the two defects test

The HGFS defect concerns the shared folders mechanism, which is how a host and a guest exchange files. Code running in the guest that can reach the HGFS channel reaches host-side parsing code, and a stack overflow in that parser is a host compromise.
The integer overflow concerns the VMXNET3 virtual network adapter, the default paravirtualised adapter for Windows guests. A guest with administrator rights controls its own network driver, which is the position from which the overflow can be triggered.
Both are the classic shape of a hypervisor escape: a device emulation layer parses input that a privileged guest controls, and a memory-safety defect in that parser crosses the boundary. The VMX process is the host-side component, and code execution there is code execution on the host.
Broadcom's advisory is the authoritative source for which configurations are affected, and the fixed build is named per product.

The shared host problem

A single workstation running one VM with no shared folders and a NAT adapter presents a small target. The same workstation running five VMs for different teams presents a host that several people can influence.
The configuration questions worth asking are specific:
Is HGFS in use? Shared folders that are enabled but unused increase the guest-to-host channel for no operational benefit.
Which network adapter is configured? The VMXNET3 relevance in the advisory applies to guests using it.
Who has administrative access inside each guest? A VM whose guest account is shared by a team is a VM where the advisory's precondition is met by anyone on the team.
Whether a host is domain-joined and reachable from the corporate network matters as much as the local configuration. A developer workstation that holds an SSH key to production is a host whose compromise is not contained by the workstation.

Verifying the patch

The fixed build is 26H1u1 for both products. Checking it is a version read, not a test: the About dialog in Workstation and Fusion reports the build, and the advisory names the build that contains the fix.
For hosts under management, an inventory query on the installed application version across the fleet produces the list that matters. Desktop software is frequently excluded from server patch reporting, and hypervisors on laptops are the clearest example.
For hosts not under management, the population is the problem. A team that installed Workstation from a vendor download and patched it when a notification appeared is not a team whose patch status can be asserted.

The incident question that follows from an escape

A guest-to-host escape leaves host-side evidence that is difficult to interpret because the host is the victim and the guest is the attacker.
The VMX process's own log, vmware.log, records device activity for each VM and is stored alongside the VM's files. Where the escape used a device channel, that log is the primary record, and it is on the host that was compromised.
The comparison worth making before an incident: are those logs collected anywhere the guest's operator cannot reach? On a shared workstation, the answer is usually no, and the practical consequence is that a host compromise may present as unexplained host behaviour with no usable record.

References

Top comments (0)