VMware Fusion CVE-2026-41702

Requires authenticated local access to the macOS system with non-administrative user privileges (standard user account). The attacker must have the ability to execute binaries and manipulate filesystem objects in directories accessible to the vulnerable SETUID binary. VMware Fusion must be installed on the target system, and the vulnerable SETUID binary must be present with setuid-root permissions (default installation). No special Fusion configuration, VM state, or user interaction required-exploitation targets the host system's privilege model rather than virtualization features. Exploitation is limited to macOS platforms only and requires existing foothold on the target system; remote exploitation is not possible without chaining with separate remote access vulnerability. The TOCTOU race condition exploitation may require multiple attempts to win the timing window, but AC:L indicates success is achievable with standard exploitation techniques.

Real-world risk is HIGH for environments where non-administrative users have local access to macOS systems running VMware Fusion. The CVSS base score of 7.8 accurately reflects the severity: local vector reduces exposure compared to remote exploits, but low attack complexity (AC:L) and no user interaction requirement (UI:N) means any local authenticated user (PR:L) can reliably exploit this to gain complete system control (C:H/I:H/A:H). TOCTOU race conditions can be challenging to exploit reliably but are well-understood attack primitives, and low AC:L suggests the timing window is exploitable without specialized techniques. The vulnerability is particularly concerning in shared workstation environments, developer machines with multiple user accounts, or systems where Fusion runs on endpoints with potential malware foothold. Without EPSS data or KEV confirmation, widespread exploitation status is unknown, but TOCTOU vulnerabilities in SETUID binaries are classic privilege escalation vectors that threat actors actively seek. No POC availability data provided, but TOCTOU exploitation techniques are well-documented in security research. Priority should be CRITICAL for any multi-user macOS systems running Fusion, MEDIUM for single-user developer workstations (depends on broader attack chain scenarios like initial access via phishing or supply chain compromise).

A malicious actor gains initial access to a macOS system running VMware Fusion through phishing, supply chain compromise, or an existing user account. With non-administrative privileges, the attacker identifies the vulnerable SETUID binary in Fusion's installation directory and crafts a race condition exploit that manipulates filesystem objects (symlinks or file replacements) during the time window between the binary's security check and its privileged operation. By winning the race condition, the attacker causes the SETUID binary to perform privileged actions on attacker-controlled files, escalating to root privileges and gaining complete control over the macOS host, including access to all virtual machines, credentials, and corporate data stored on the system.