Broadcom Patches Critical VMware Workstation Flaw That Lets Admins Escape to the Host

Key points

• Broadcom patched two security bugs in VMware Workstation and VMware Fusion, the company's desktop virtualisation products, in November 2025.
• The serious flaw, CVE-2025-59346, carries a severity score of 9.3 out of 10.
• It is an integer-overflow bug, a common programming mistake where a number grows too large for its memory slot and corrupts nearby data.
• A local attacker who already has admin rights inside a virtual machine can use it to run code on the host computer.
• No active attacks have been seen in the wild, but home labs and developer laptops running VMware should update now.

Broadcom, which owns VMware, has shipped fixes for two flaws in Workstation and Fusion, the desktop programs that let people run a second operating system inside a window on their PC or Mac. One of the bugs is bad enough that it lets an attacker break out of the virtual sandbox and touch the real machine underneath.

That is the scenario virtualisation is specifically designed to prevent. It is also the scenario security researchers spend the most time hunting for.

What is the flaw, in plain English?

The headline bug is CVE-2025-59346, an integer-overflow vulnerability rated 9.3 out of 10 on the industry severity scale. In simple terms, the program expects a number of a certain size, gets a bigger one, and the maths wraps around like a car odometer rolling over from 999999 back to zero. That confusion lets an attacker slip malicious instructions into memory the program is about to run.

Broadcom says an attacker needs local access and elevated privileges inside the guest virtual machine. Translation: they must already be an administrator on the pretend computer running inside the window. From there, the bug lets them execute code on the host: the actual laptop or desktop the software is installed on.

Security people call this a guest-to-host escape. It is roughly the virtualisation-world equivalent of a web browser sandbox escape, where a rogue tab breaks out and starts poking at the operating system.

Who is affected?

Anyone running VMware Workstation on Windows or Linux, or VMware Fusion on a Mac, is potentially in scope. These are the products developers, students, IT staff and home tinkerers use to run Linux inside Windows, test malware in an isolated environment, or keep an old copy of Windows XP around for one stubborn application.

Enterprise VMware products like ESXi and vSphere, the ones running data centres, are not called out in this advisory. This one is a desktop story.

Should ordinary users worry?

Not in a panic sense, no. The attacker has to already control the virtual machine as an admin, so this is not something a stray email or website will trigger on its own. The realistic risk is for people who deliberately run untrusted software inside a VM, thinking the wall between guest and host will hold. That wall now has a documented crack until you patch.

The fix is straightforward. Open Workstation or Fusion, check for updates, install, restart. If you manage a fleet of developer machines, push the update through your usual software distribution tool this week rather than next month.

As The Hacker News noted in its writeup, there is no sign yet of anyone exploiting this bug in the wild. That window tends to close quickly once a patch reveals what to look for, which is why timely updates matter more than the current threat level suggests.

Common questions

Can this bug be triggered by visiting a website inside a VM?

No. The attacker needs administrator access inside the guest virtual machine first. Casual browsing from a standard user account inside the VM is not the attack path described.

Does this affect VMware ESXi or vSphere in the data centre?

Broadcom's advisory covers Workstation and Fusion, the desktop products. Server-side VMware customers should still read the official advisory to confirm their specific build is unaffected.