A stack-based buffer overflow in VMware Workstation and Fusion’s HGFS subsystem allows a malicious actor with local administrative privileges inside a virtual machine to exploit the fault and execute code within the host’s VMX process. The vulnerability directly grants the attacker the same privileges as the host hypervisor component, enabling arbitrary host‑side code execution and a full compromise of the host system.

The flaw affects VMware Fusion and VMware Workstation versions 25H2 and 26H1. Both product lines are fixed in update 26H1u1. No other versions are listed as affected.

The CVSS score of 8.1 reflects a high severity risk. No EPSS score is available, and the vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector requires local administrative access on the guest virtual machine, after which the local exploit can be triggered. If VMs run untrusted software with elevated privileges, the attacker can easily leverage this defect to escape the guest sandbox and acquire host‑level control.