7.8
High
CVE-2026-41702 VMware Fusion contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during an operation performed by a…
Description
VMware Fusion contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during an operation performed by a SETUID binary. A malicious actor with local non-administrative user privileges may exploit this vulnerability to escalate privileges to root on the system where Fusion is installed.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Fusion 2025 | 2025H2 → < 2026H1 | 2026H1 |
Other CVEs of Fusion
The 49 CVEs of Fusion →
CVE-2026-41703
VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability
7.6
High
CVE-2026-22715
VMWare Workstation and Fusion contain a logic flaw in the management of network packets. Known attack vectors: A…
5.9
Medium
CVE-2025-41239
VMware ESXi, Workstation, Fusion, and VMware Tools contains an information disclosure vulnerability due to the usage…
7.1
High
CVE-2025-41238
VMware ESXi, Workstation, and Fusion contain a heap-overflow vulnerability in the PVSCSI (Paravirtualized SCSI)…
9.3
Critical