security_identifier

VMSA-2026-0007

Broadcom security advisory covering two guest-to-host code execution vulnerabilities in VMware Workstation and Fusion.

Current clusters

security2 distinct publishers

Guest admin is enough to break out of VMware Workstation onto the host

Broadcom's VMSA-2026-0007 fixes an integer overflow in the VMXNET3 adapter and a stack overflow in HGFS, both reachable by a local administrator inside the VM, and the only remedy on offer is version 26H1u1.

Publishers:securityaffairs.comsecurityweek.com

Reality

Evidence72
Adoption20
Hype gap+10
Incentives45
Confidence74