PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-41702 VMware CVE debrief

A Time-of-check Time-of-use (TOCTOU) vulnerability in VMware Fusion allows local privilege escalation to root. The flaw exists in a SETUID binary operation, where a race condition between checking a resource's state and using it can be exploited by an attacker with local non-administrative access. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates high impact across confidentiality, integrity, and availability with low attack complexity. Broadcom (VMware's parent company) has issued a security advisory addressing this vulnerability.

Vendor
VMware
Product
Fusion
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-15
Original CVE updated
2026-05-18
Advisory published
2026-05-15
Advisory updated
2026-05-18

Who should care

Organizations running VMware Fusion on macOS endpoints, particularly multi-user environments or systems where non-administrative users have local access. Security teams managing virtualized development environments and macOS endpoint security programs.

Technical summary

CVE-2026-41702 is a TOCTOU (CWE-367) vulnerability in VMware Fusion affecting versions prior to 26h1. The vulnerability resides in a SETUID binary operation where an attacker can win a race condition between state verification and resource use. Successful exploitation allows a local non-privileged user to escalate to root privileges on the host system. The attack requires local access but no user interaction, with low complexity. The fix version 26h1 addresses the race condition in the affected SETUID binary.

Defensive priority

HIGH

Recommended defensive actions

  • Apply VMware Fusion 26h1 or later to remediate the TOCTOU vulnerability
  • Restrict local access to systems running VMware Fusion to trusted users only
  • Monitor for anomalous SETUID binary execution patterns on macOS hosts running Fusion
  • Review Broadcom security advisory for additional vendor-specific mitigation guidance

Evidence notes

CVE published 2026-05-15; modified 2026-05-18. Vendor advisory confirms TOCTOU condition in SETUID binary. CWE-367 (Time-of-check Time-of-use race condition) identified. Affected versions: VMware Fusion prior to 26h1.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-41702 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-41702

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-41702 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-41702

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.