TI-2026-30218 Aliases CVE-2026-41702 GHSA-gwg2-qh78-562m

TOCTOU local privilege escalation vulnerability

LOW 35CWE-367Published 2026-05-15 · Updated 2026-05-15

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

VMware Fusion contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during an operation performed by a SETUID binary. A malicious actor with local non-administrative user privileges may exploit this vulnerability to escalate privileges to root on the system where Fusion is installed.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00169 6th percentileScored 2026-11-07

Fix Fixed Fusion (VMware): 2026H1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
VMware	Fusion	2025H2 to before 2026H1	2026H1	Patch available	CNA

Fusion VendorVMware Affected 2025H2 to before 2026H1 Fixed in 2026H1 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:vmware:fusion::::::::	before 26h1	Vulnerable	VMware

cpe:2.3:a:vmware:fusion:*:*:*:*:*:*:*:* Versions before 26h1 Vulnerable ·VMware

Remediation

Fix · CNA Fusion (VMware) Fixed in 2026H1

Timeline

2026-10-02 Threatist record created from CVE-2026-41702
2026-10-03 Alias added: GHSA-gwg2-qh78-562m

References

Advisory 1

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37454

TI-2020-03448 Improper privilege management in VMware Fusion, VMware Remote Console for Mac and Horizon… KEVCVSS 3.1HIGH 7.8
TI-2025-16137 Out-of-bounds read in ESXi KEVCVSS 3.1HIGH 7.1
TI-2017-03716 Observable discrepancy in Intel Most Modern Operating Systems CVSS 3.1MEDIUM 5.6
TI-2017-03034 Memory corruption in VMware Workstation Pro/Player CVSS 3.0CRITICAL 9.9
TI-2016-04622 Untrusted search path vulnerability in the HGFS (aka Shared Folders) feature in VMware… CVSS 3.1HIGH 7.8
TI-2011-03420 Buffer overflow in VMware Workstation 7.x before 7.1.5, VMware Player 3.x before 3.1.5… CVSS 2.0HIGH 9.3

See all 130 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences