Broadcom Patches Critical VMware Workstation Flaw That Lets Admins Escape to the Host

Key points

• Broadcom patched two security bugs in VMware Workstation and VMware Fusion, the company's desktop virtualisation products.
• The serious flaw, CVE-2025-59346, carries a severity score of 9.3 out of 10.
• It's an integer-overflow bug, a common programming mistake where a number grows too large for its memory slot and corrupts nearby data.
• A local attacker who already has admin rights inside a virtual machine can use it to run code on the host computer.
• No active attacks have been seen, but anyone running VMware on a desktop or laptop should update now.

Broadcom, which owns VMware, has shipped fixes for two flaws in Workstation and Fusion, the desktop programs that let people run a second operating system inside a window on their PC or Mac. One of the bugs lets an attacker break out of the virtual sandbox and reach the real machine underneath. That's the scenario virtualisation is specifically designed to prevent.

What is the flaw, in plain English?

The headline bug is CVE-2025-59346, an integer-overflow vulnerability rated 9.3 out of 10 on the industry severity scale. The program expects a number of a certain size, receives a larger one, and the arithmetic wraps around past its maximum value. That confusion lets an attacker slip malicious instructions into memory the program is about to execute.

Broadcom says the attacker needs local access and elevated privileges inside the guest virtual machine. They must already be an administrator on the pretend computer running inside the window. From there, the bug lets them execute arbitrary code on the host: the actual laptop or desktop the software is installed on.

Security researchers call this a guest-to-host escape. It's roughly the virtualisation equivalent of a browser sandbox escape, where a rogue tab breaks out and starts poking at the operating system. We reported on VMware flaws being actively exploited as recently as 19 August, in "CISA Orders Urgent Fixes for Four Actively Exploited Flaws in Windows, VMware, and macOS".

Who is affected?

Anyone running VMware Workstation on Windows or Linux, or VMware Fusion on a Mac, is potentially in scope. These are the products developers, IT staff and home tinkerers use to run Linux inside Windows, test malware in isolation, or keep an old operating system around for one stubborn application.

Enterprise VMware products like ESXi and vSphere aren't called out in this advisory. This is a desktop story.

Should ordinary users worry?

Not in a panic sense. The attacker has to already control the virtual machine as an admin, so a stray email or website won't trigger this on its own. The realistic risk is for people who deliberately run untrusted software inside a VM, trusting the wall between guest and host to hold. That wall now has a documented crack until you patch.

The fix is straightforward: open Workstation or Fusion, check for updates, install, restart. If you manage a fleet of developer machines, push the update this week. Don't wait for next month's maintenance window.

As The Hacker News noted in its writeup, there's no sign yet of exploitation in the wild. That window tends to close quickly once a patch reveals what to look for.

Common questions

Can this bug be triggered by visiting a website inside a VM?

No. The attacker needs administrator access inside the guest virtual machine first. Browsing from a standard user account inside the VM isn't the attack path described.

Does this affect VMware ESXi or vSphere in the data centre?

Broadcom's advisory covers Workstation and Fusion only. Server-side VMware customers should still read the official advisory to confirm their specific build is unaffected.