CVE-2026-41702 - TOCTOU local privilege escalation vulnerability

Back Back to CVE browser

HIGH

TOCTOU local privilege escalation vulnerability

Published May 15, 2026

7.8

HIGH

CVSS 3.1

EPSS 0.11%

Description

VMware Fusion contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during an operation performed by a SETUID binary. A malicious actor with local non-administrative user privileges may exploit this vulnerability to escalate privileges to root on the system where Fusion is installed.

Affected products

Vendor VMware Product Fusion Default
unaffected
- Version
  2025H2
  Status
  affected
  Constraints
  <2026H1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

VMware

Fusion

unaffected

Version	Status	Constraints
2025H2	affected	<2026H1

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-367

References (1)

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37454
Vendor Advisory

Link	Providers	Tags
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37454		Vendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner vmware

Published May 15, 2026

Updated May 15, 2026

Reserved Apr 22, 2026

Link CVE-2026-41702

CISA Vulnrichment

Updated May 15, 2026

NVD

Status Analyzed

Modified Jun 17, 2026

Link CVE-2026-41702

Red Hat

Severity n/a

Public date n/a

Links CVE-2026-41702