CVE-2026-59346: Critical VMware Workstation and Fusion Flaw Enables Guest-to-Host Code Execution

CVE-2026-59346 is a critical integer-overflow flaw in VMware's VMXNET3 virtual network adapter allowing an attacker with administrative privileges inside a guest VM to potentially escape the guest and execute code on the host (CVSS 9.3). Broadcom released fixes in VMware Workstation and Fusion 26H1u1 for affected 25H2 and 26H1 branches; no vendor workaround is available. Public PoC demonstrating host crashes exists but there is no confirmed active exploitation in the wild; recommended actions are to prioritize patching, restrict guest administrative access, and monitor host-side abnormalities.