Workstation and Fusion run each VM through a vmware-vmx process on the host desktop, the same device-emulation code as ESXi. The escape surface is therefore the same: the SVGA 3D graphics adapter, USB controllers, and virtual NICs parse guest input in the host process, and memory-corruption flaws there run code on the host.
Shared escape surface with ESXi:
- SVGA / 3D graphics (the primary target)
- USB controllers (UHCI/EHCI/XHCI)
- Virtual NICs (vmxnet3, e1000)
Exploitation notes#
- Because the device code is shared, escapes often affect ESXi, Workstation, and Fusion together; the difference is the host OS the escape lands on.
- Analysis sandboxes commonly leave 3D acceleration and Shared Folders enabled, widening the surface; see Shared folder and drag-drop abuse.
- Named instances are under Known escape exploits; the ESXi view is ESXi guest to host escape.