New VMware Workstation and Fusion Flaws Could Let Malware Escape Virtual Machines

Broadcom’s latest security advisory flags two critical vulnerabilities in VMware’s flagship desktop virtualization products, Workstation and Fusion, that could enable a malicious actor to break out of a guest VM and execute code on the host operating system. The advisory, released in early September, categorises the flaws as "critical" and advises immediate mitigation.

The vulnerabilities stem from flaws in the way the hypervisor handles certain device emulation functions. By crafting specially designed inputs, an attacker who already has foothold inside a virtual machine could trigger a buffer overflow or manipulate memory structures, ultimately gaining the ability to run arbitrary code on the physical host. This type of “VM escape” undermines the fundamental isolation guarantees that virtualization platforms promise to both enterprise and personal users.

VMware has confirmed that the issues affect all supported versions of Workstation 16 and newer, as well as Fusion 12 and newer, on Windows, Linux, and macOS hosts. The company has not disclosed a CVE identifier at the time of publication, but notes that the bugs were discovered by an external security researcher who reported them responsibly. Broadcom, which now owns VMware’s security division, recommends that administrators apply the forthcoming patches as soon as they are available and, in the interim, consider disabling the vulnerable device features where possible.

The advisory arrives at a time when remote work and cloud‑based development environments have driven broader adoption of desktop virtualization. For many organizations, Workstation and Fusion serve as testbeds for software development, security research, and legacy application support. A successful VM escape could allow an attacker to pivot from a low‑privilege sandbox into a privileged host, potentially accessing sensitive data, installing persistent malware, or compromising network resources.

Security experts stress that while the vulnerabilities require an attacker to first compromise a guest VM—a step that may not be trivial—they nonetheless represent a serious escalation risk. "Even if the initial breach occurs in a seemingly isolated environment, the ability to move laterally to the host expands the attack surface dramatically," said a senior analyst at a cybersecurity consultancy who declined to be named. The analyst added that organizations should review their virtualization security policies, enforce strict network segmentation, and keep hypervisor software up to date.

VMware has pledged to release patches within the next few days and will provide detailed remediation guidance on its security advisory portal. In the meantime, Broadcom advises users to monitor for any unusual host‑level activity, restrict VM access to trusted personnel, and employ additional hardening measures such as enabling secure boot and using hardware‑based virtualization extensions. As the patches roll out, the incident underscores the ongoing challenge of securing the increasingly complex layers of modern computing environments.