1 article on this topic.
Broadcom has patched a critical integer-overflow bug in VMware Workstation and Fusion that lets an attacker with admin rights inside a VM run code on the host — plus a related HGFS buffer overflow. Neither is remotely exploitable, but both break the guest/host boundary that desktop virtualization depends on.