Skip to content
OpenAdvisories
High · 7.8 CVE-2026-41702 EUVD-2026-30510GHSA-gwg2-qh78-562m

TOCTOU local privilege escalation vulnerability

Published May 15, 2026 · Updated May 15, 2026 · Assigned by vmware

Description

VMware Fusion contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during an operation performed by a SETUID binary. A malicious actor with local non-administrative user privileges may exploit this vulnerability to escalate privileges to root on the system where Fusion is installed.

Affected products

VendorProductAffectedFixed
VMware Fusion 2025H2 – < 2026H1 2026H1

Advisories 1

References