CVE-2026-41702
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
VMware Fusion contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during an operation performed by a SETUID binary. A malicious actor with local non-administrative user privileges may exploit this vulnerability to escalate privileges to root on the system where Fusion is installed.
Risk Assessment
This vulnerability may lead to unauthorized access to the system with administrative privileges, posing a serious security threat to the organization.
Recommendation
It is recommended to update VMware Fusion to the latest version to mitigate this vulnerability and to restrict access to the system for users with low privileges.
Other vulnerabilities in VMware Fusion
Original NVD description (English source)
VMware Fusion contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during an operation performed by a SETUID binary. A malicious actor with local non-administrative user privileges may exploit this vulnerability to escalate privileges to root on the system where Fusion is installed.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS