Broadcom Patches Critical VMware Fusion Privilege Escalation Flaw
Severity: High (Score: 70.5)
Sources: Securityaffairs.Co, Scworld
Summary
Broadcom has released a critical security update for VMware Fusion to address CVE-2026-41702, a high-severity vulnerability that allows local attackers to escalate privileges to root on affected systems. This time-of-check time-of-use (TOCTOU) flaw affects operations performed by a SETUID binary, enabling non-administrative users to gain complete control over vulnerable machines. While the vulnerability requires local access, it significantly increases the risk from compromised user accounts or insider threats. VMware Fusion is widely used by developers, IT professionals, and security researchers on macOS. The patch is essential for safeguarding systems against potential exploitation. Broadcom's prompt action highlights the importance of addressing such vulnerabilities to protect user data and system integrity. Key Points: • CVE-2026-41702 allows local privilege escalation to root on VMware Fusion systems. • The vulnerability is a TOCTOU flaw affecting SETUID binaries, requiring local access to exploit. • Broadcom has released a critical security update to mitigate the risk associated with this flaw.
Key Entities
- CVE-2026-41702 (cve)
- CWE-269 - Improper Privilege Management (cwe)
- Cwe-362 - Race Condition (cwe)
- CWE-367 - TOCTOU Race Condition (cwe)
- T1068 - Exploitation for Privilege Escalation (mitre_attack)
- MacOS (platform)
- VMware Fusion (platform)