Vulnerabilities
VMware Workstation VMXNET3 Integer Overflow (CVE-2026-59346)
A local privilege escalation vulnerability exists in VMware Workstation due to an integer overflow in the VMXNET3 virtual device. Successful exploitation requires prior high-privileged code execution within the guest OS. Defenders should apply the vendor-provided patch immediately.
What Happened
A vulnerability (CVE-2026-59346) has been identified in VMware Workstation related to the VMXNET3 virtual network adapter. This flaw is an integer overflow that occurs during buffer allocation, potentially leading to privilege escalation.
Impact
Successful exploitation allows a local attacker, who already possesses high privileges within a guest operating system, to escalate their privileges further and execute arbitrary code within the hypervisor context. The ZDI rates the vulnerability with a CVSS score of 7.5 (AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).
What to Do
- Patch Immediately: Apply the security update released by VMware. Details are available at https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38288.
- Review Guest OS Security: Harden guest operating systems to minimize the risk of an attacker gaining initial high-privileged access.
- Monitor for Exploitation: While direct detection may be difficult, monitor for anomalous activity within VMware Workstation environments.
Technical Details
The vulnerability stems from insufficient validation of user-supplied data within the VMXNET3 implementation, leading to an integer overflow during buffer allocation. This allows an attacker to control buffer size and potentially overwrite memory regions.
Related vulnerabilities
GitLab CVE-2026-97229: Unauthenticated Remote Code Execution via CI/CD Regex Overflow
A critical integer overflow in GitLab’s CI/CD regex compiler allows unauthenticated remote code execution on self‑managed instances. Attackers must first inject a malicious .gitlab-ci.yml into a public repository. Immediate patching of all unpatched GitLab CE/EE deployments is required.
Read briefing
CVE-2026-102856: Visio RCE via Heap Overflow
A heap-based buffer overflow vulnerability exists in Microsoft Visio. Successful exploitation allows a remote, unauthenticated attacker to achieve arbitrary code execution. Defenders should prioritize patching Visio installations.
Read briefing
Critical GitLab CE/EE Vulnerability (CVE-2026-97229) – Immediate Upgrade Required
An integer‑overflow flaw in GitLab’s CI/CD regex compiler (CVE‑2026‑97229) allows unauthenticated code execution on self‑managed instances. All GitLab Community and Enterprise Editions older than 19.4.2, 19.3.4, or 19.2.8 must be patched immediately, prioritizing internet‑facing deployments.
Read briefing
Orthanc DICOM Server <1.13.0 Suffers Heap Overflow from PNG Decode – CVE‑2026‑87020
Orthanc DICOM Server versions older than 1.13.0 are vulnerable to an integer overflow that occurs during PNG or JPEG decoding. An attacker who can authenticate to the server can supply a crafted image that causes a heap out‑of‑bounds write, crashing the Orthanc process and delivering a denial‑of‑service. The flaw, identified as CVE‑2026‑87020, poses a high‑severity risk to healthcare and public‑health infrastructure worldwide. Orthanc recommends upgrading immediately to 1.13.0 and, where possible, restricting external access to the server with firewalls or VPNs.
Read briefing