Vmware Fusion up to 25H2U1 toctou

Summaryinfo

A vulnerability identified as critical has been detected in Vmware Fusion. Impacted is an unknown function. Performing a manipulation results in toctou. This vulnerability is cataloged as CVE-2026-41702. The attack must be initiated from a local position. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in Vmware Fusion. This affects some unknown functionality. The manipulation with an unknown input leads to a toctou vulnerability. CWE is classifying the issue as CWE-367. The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

VMware Fusion contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during an operation performed by a SETUID binary. A malicious actor with local non-administrative user privileges may exploit this vulnerability to escalate privileges to root on the system where Fusion is installed.

The advisory is shared at support.broadcom.com. This vulnerability is uniquely identified as CVE-2026-41702 since 04/22/2026. The exploitability is told to be easy. An attack has to be approached locally. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 05/21/2026).

The vulnerability scanner Nessus provides a plugin with the ID 315231 (VMware Fusion 25H2 < 26H1 Local Privilege Escalation (VMSA-2026-0003)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 2026H1 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (315231) and EUVD (EUVD-2026-30510). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Vmware

Name

• Fusion

Version

• 1.0
• 1.1
• 1.1.1
• 1.1.2
• 1.1.3
• 2.0
• 2.0.1
• 2.0.2
• 2.0.3
• 2.0.4
• 2.0.5
• 2.0.6
• 2.0.7
• 2.0.8
• 3.1
• 3.1.1
• 3.1.2
• 4.0
• 4.1
• 5.0
• 5.1
• 8.5
• 9.0
• 9.0.1
• 10.1.2
• 11
• 11.0.0
• 11.0.1
• 11.0.2
• 11.0.3
• 13.0.2
• 13.5
• 13.6
• 25H2U1

License

• commercial

Website

• Vendor: https://www.vmware.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion