CVE-2026-41703: VMware ESXi, Workstation, and Fusion out-of-bounds read

CVE-2026-41703 · Severity: high · CVSS 7.6 · Published 2026-07-30

VMware virtualization products (ESXi, Workstation, and Fusion) contain a security flaw that can be triggered by users with permissions to deploy virtual machines. On enterprise ESXi systems, an attacker could crash the host server or access sensitive information. On personal Workstation and Fusion software, the risk is limited to the unauthorized disclosure of information.

Technologies: VMware Cloud Foundation, VMware ESXi, VMware Fusion, VMware Workstation. Vendors: VMware.

Quick answers

Is CVE-2026-41703 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41703 being exploited in the wild.
How severe is CVE-2026-41703?
High severity, with a CVSS score of 7.6, published 30 July 2026.
Which products and versions are affected?
VMware Cloud Foundation 5.x before 5.2.3, 9.0.x.x, 9.1.x.x; VMware ESXi 9.1.x.x before ESXi-9.1.0.0-25370933, 9.0.x.x before ESXi-9.0.2.0100-25595025, 8.0 before ESXi80U3i-25205845; VMware Fusion 25H2 before 26H1; VMware Workstation 25H2 before 26H1.
Is there a fix for CVE-2026-41703?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-41703 attacked?
It is attacked over the network, in an operating system.
Am I affected by CVE-2026-41703?
Check whether you run VMware Cloud Foundation, VMware ESXi, VMware Fusion or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds read vulnerability (CWE-125) exists in VMware ESXi, Workstation, and Fusion. A malicious actor with VM deployment privileges can exploit this flaw via the network to trigger an out-of-bounds memory access. On ESXi, this can result in a Denial-of-Service (DoS) of the host process or information disclosure. On Workstation and Fusion, the impact is limited to information disclosure. Patches are available for affected versions, including ESXi 8.0, 9.0, and 9.1, and Workstation/Fusion version 26H1.

Affected products

  • VMware ESXi 9.1.x.x before ESXi-9.1.0.0-25370933, 9.0.x.x before ESXi-9.0.2.0100-25595025, 8.0 before ESXi80U3i-25205845
  • VMware Workstation 25H2 before 26H1
  • VMware Fusion 25H2 before 26H1
  • VMware Cloud Foundation 5.x before 5.2.3, 9.0.x.x, 9.1.x.x
  • VMware Telco Cloud Platform 5.0.x, 5.1.x

Timeline

  • 2026-07-29: advisory: Initial publication by Broadcom (VMSA-2026-0006)
  • 2026-07-30: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.