SecBoard
Zurück zur CVE-Übersicht

CVE-2026-59347

HIGH(8.1)

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Risk Signal Score20/100 — NIEDRIG
  • CVSS 8.1 — Hoch

EPSS-Score

0.2%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

8.1

Technische Schwere

Beschreibung

VMware Workstation and Fusion contain a stack-based buffer-overflow vulnerability in HGFS. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. Affected versions: - VMware Workstation: 25H2, 26H1 (fixed in 26H1u1) - VMware Fusion: 25H2, 26H1 (fixed in 26H1u1)

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • VMware Workstation 26H1u1
  • VMware Fusion 26H1u1

Threat-Hunting-Queries

Detection for local administrative privilege escalation to host VMX process via HGFS stack-based buffer overflow. Focus on unusual process behavior from the VM's VMX process on the host.

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "vmware-vmx.exe"
| where FileName in ("powershell.exe", "cmd.exe", "sh", "bash") or ProcessCommandLine contains "-EncodedCommand"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, FolderPath

Splunk SPL

index=* sourcetype=WinEventLog:Security (ParentProcessName="vmware-vmx.exe" AND (ProcessName IN ("powershell.exe", "cmd.exe") OR CommandLine=*EncodedCommand*)) OR (ParentProcessName="vmware-vmx.exe" AND (ProcessName IN ("sh", "bash")))
| table _time, host, ParentProcessName, ProcessName, CommandLine

Sigma

title: VMware HGFS Stack Buffer Overflow Host Code Execution
status: experimental
description: Detects potential exploitation of CVE-2026-59347 where a VM with local admin privileges executes code as the VMX process on the host.
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\vmware-vmx.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\sh'
      - '\bash'
  condition: selection

Elastic ES|QL

FROM process WHERE event.type == "start" AND process.parent.executable == "vmware-vmx.exe" AND (process.executable IN ("powershell.exe", "cmd.exe", "sh", "bash") OR process.args LIKE "*-EncodedCommand*")

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen