A 16-year-old vulnerability allows an attacker to escape a virtual machine, gain access to the host, and execute malicious code.