Description
VMware Fusion contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during an operation performed by a SETUID binary. A malicious actor with local non-administrative user privileges may exploit this vulnerability to escalate privileges to root on the system where Fusion is installed.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| VMware | Fusion | 2025H2 – < 2026H1 | 2026H1 |
Advisories 1
- WID-SEC-2026-1526 VMware Fusion: Schwachstelle ermöglicht Privilegieneskalation BSI CERT-Bund (WID) · May 14, 2026