CVE-2026-41702

7.0 Élevée

Publiée le 15/05/2026 à 09:16 · Modifiée le 17/06/2026 à 12:47 · Analysée par le NVD · Source : security@vmware.com

Description

VMware Fusion contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during an operation performed by a SETUID binary. A malicious actor with local non-administrative user privileges may exploit this vulnerability to escalate privileges to root on the system where Fusion is installed.

Traduire en français

Produits concernés

VMware Fusion

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.8 Élevée	security@vmware.com	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
3.1	7.0 Élevée	nvd@nist.gov (NVD)	`CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-367

Références

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37454 Vendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories