Both bugs live in code the host exposes to the guest on purpose. VMXNET3 is VMware's own virtual network adapter for virtual machines [3]. HGFS is the feature that lets a guest read files and directories sitting on the physical host [5]. Parsing input that originates inside the VM is their job.
The scores invert the reach. CVE-2026-59346 carries a 9.3 but requires the VM to be configured with a VMXNET3 adapter [2]. CVE-2026-59347 carries an 8.1 and, per Broadcom's wording, needs nothing beyond local administrative privileges on the virtual machine [4]. That is a 1.2-point gap on the scale in favour of the bug with the narrower configuration precondition [2]. Neither requires any foothold on the host itself [1].
On a malware analysis workstation or a developer sandbox, code running as administrator inside the guest is the expected starting state rather than a hurdle an attacker still has to clear. In that setup, the bug is what separates the sample from the host [3]. The sources do not say how many such installations exist, and neither advisory writeup quantifies use cases.
The fix is single-track. Both 25H2 and 26H1 are affected, and both are resolved only in 26H1u1 [7], so a 25H2 install does not receive a patch in place; it receives a version move [4]. That applies to Workstation on Windows and Linux and to Fusion on macOS [6]. Broadcom offers no workaround for either flaw and recommends updating as soon as possible [8].
What is public: the advisory, the CVSS scores, and the credits. h4urek with secsys lab and Y² reported the VMXNET3 overflow, as did Stan S working with the TrendAI Zero Day Initiative, independently of one another [11]. Yeonghyeon Choi and Tianchu Chen of Tencent Xuanwu Lab reported the HGFS overflow [12]. Both reports converge on the same virtual NIC, and that convergence, from two separate research lines working independently, is what suggests a reachable bug class rather than a single lucky crash.
What is not public: any exploitation. Broadcom makes no mention of either issue being used in the wild and says both were reported privately, according to SecurityWeek, which dates the announcement to Thursday [9][13]. Set against that, SecurityWeek also counts more than two dozen VMware vulnerabilities currently on CISA's Known Exploited Vulnerabilities list [10]. Privately reported VMware flaws have a track record of reappearing as tooling, and the absence of a configuration change to fall back on means the only variable here is how quickly 26H1u1 gets deployed.
