"Broadcom announced on Thursday that it has released a VMware Fusion update to patch a high-severity vulnerability. The flaw, tracked as CVE-2026-41702 and rated 'important' by the vendor, was reported by Mathieu Farrell. An advisory describes CVE-2026-41702 as a time-of-check time-of-use (TOCTOU) flaw that "occurs during an operation performed by a SETUID binary"."
""A malicious actor with local non-administrative user privileges may exploit this vulnerability to escalate privileges to root on the system where Fusion is installed," the advisory explains. VMware may announce several more patches in the coming days, as its products will be targeted at this week's Pwn2Own hacking competition."
"VMware owner Broadcom has sent members of its security team to the event, where participants are expected to demonstrate ESX exploits that can earn them up to $200,000. VMware Workstation, which in recent years has earned significant rewards for Pwn2Own participants, has been removed from the list of targets."
"Broadcom's advisory does not mention CVE-2026-41702 being used in attacks, but vulnerabilities in VMware products are often exploited in the wild. CISA's KEV catalog currently includes 26 VMware flaws. Related: VMware Aria Operations Vulnerability Could Allow Remote Code Execution"
Broadcom released a VMware Fusion update to address a high-severity vulnerability tracked as CVE-2026-41702. The vendor rated the flaw as important. The vulnerability is a time-of-check time-of-use issue that occurs during an operation performed by a SETUID binary. A local non-administrative user may exploit it to escalate privileges to root on the system where Fusion is installed. Additional patches may follow as VMware products are expected to be targeted at the Pwn2Own hacking competition. Broadcom has security team members attending, where participants may demonstrate ESX exploits for rewards. VMware Workstation is not listed as a target. The advisory does not mention active exploitation, though VMware vulnerabilities are frequently exploited in the wild and CISA’s KEV catalog includes multiple VMware flaws.
Read at SecurityWeek
Unable to calculate read time
Collection
[
|
...
]