Executive brief
VMware Fusion, a desktop hypervisor used to run virtual machines on Mac computers, contains a security flaw that could allow a standard user to gain full administrative control. By exploiting a timing error in how the software handles internal system files, a local attacker can elevate their privileges to 'root' level. This would allow them to bypass security restrictions, access sensitive data, or modify the underlying operating system.
Technical details
A Time-of-check Time-of-use (TOCTOU) race condition exists within a SETUID binary in VMware Fusion. The vulnerability occurs when the application checks a file's properties or state but the state changes before the application performs a subsequent operation on that file. A local attacker with low-level privileges can exploit this race condition to manipulate file operations, leading to an escalation of privileges to root. The issue is tracked as CVE-2026-41702 and has been addressed in VMware Fusion version 26H1.
Affected products
- VMware Fusion 25H2
Timeline
- 2026-05-14: advisory: Initial VMSA-2026-0003 advisory published by Broadcom
- 2026-05-14: patched: Fixed in version 26H1
- 2026-05-15: disclosed: NVD publication date