Yes, it is entirely possible for software to break out of a virtual machine and run code on other VMs or the host. Isolating something in a virtual machine does provide rather good security, but none is perfect. Vulnerabilities have existed in many virtualization systems which allowed this to happen.