VMware Workstation and Fusion contain an integer-overflow flaw in the VMXNET3 virtual network adapter. A local administrator that has privileges within a virtual machine can trigger the overflow and cause the host to execute arbitrary code. The vulnerability is identified as CWE-190 and allows a privileged virtual machine user to compromise the host system.

The flaw affects VMware Fusion and VMware Workstation releases 25H2 and 26H1. The security fix is available in the 26H1u1 update for both products. No earlier patches are known to address the issue.

The CVSS score of 9.3 indicates a critical severity, and although an EPSS value is not provided, the lack of exploitation data does not diminish the high inherent risk. The vulnerability is not listed in CISA KEV, but the local-VM‑administrator attack vector coupled with the high severity suggests that a threat actor with the ability to run any code inside a guest can gain full control of the host. The primary impact is code execution on the host, posing significant confidentiality, integrity, and availability risks.