CVE-2026-41702 — TOCTOU local privilege escalation vulnerability

CVE-2026-41702

TOCTOU local privilege escalation vulnerability PUBLISHED

Description (CNA)

VMware Fusion contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during an operation performed by a SETUID binary. A malicious actor with local non-administrative user privileges may exploit this vulnerability to escalate privileges to root on the system where Fusion is installed.

Affected (CNA)

Vendor / product	Versions
VMware / Fusion	affected 2025H2 before 2026H1

CWE

CWE-367

References

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37454

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.