What is the CVSS score of CVE-2026-41703?

CVE-2026-41703 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.6%.

Which versions of VMware ESX are affected by CVE-2026-41703?

CVE-2026-41703 affects VMware ESX, Workstation, and Fusion hypervisors through a privilege-gated out-of-bounds read with no public exploit identified at time of analysis, enabling host-level…. A patch is available.

How to fix or mitigate CVE-2026-41703?

Within 24 hours, catalog all VMware ESX, Workstation, and Fusion instances and audit which accounts hold VM deployment privileges. Within 7 days, restrict VM deployment permissions to trusted administrators only, enable detailed logging of VM deployment operations, and implement network isolation between VM and hypervisor management traffic. Within 30 days, monitor VMware security advisories continuously for patch availability, conduct a comprehensive privilege access review across your virtualization platform, and establish processes to deploy patches immediately upon vendor release.

VMware ESX CVE-2026-41703

EUVD-2026-51106 HIGH

Out-of-bounds Read (CWE-125)

2026-07-30 vmware

GHSA-m337-3vqr-5pf8

Buffer Overflow Information Disclosure VMware Cloud Foundation Fusion Telco Cloud Platform Workstation Esx Vsphere Foundation

7.6

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

7.6 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

ENISA EUVD

HIGH

qualitative

vuln.today AI

7.6 HIGH

Actor needs VM deployment rights so PR:H; guest-to-host crossing gives S:C; high info disclosure (C:H) and low host DoS (A:L), no integrity impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:L/SC:L/SI:N/SA:L

Primary rating from Vendor (vmware).

CVSS VectorVendor: vmware

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Patch available

Jul 30, 2026 - 14:03 EUVD

Analysis Generated

Jul 30, 2026 - 13:23 vuln.today

CVE Published

Jul 30, 2026 - 12:39 cve.org

HIGH 7.6

DescriptionCVE.org

VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability. A malicious actor with VM deployment privileges could trigger an out-of-bounds read, potentially leading to information disclosure or more likely a Denial-of-Service (DoS) condition of the host process. On Workstation and Fusion, the impact of this vulnerability is restricted to information disclosure.

Articles & Coverage 1

News 4 New VMware Vulnerabilities - 3 Critical, 1 High Severity Jul 31, 2026

AnalysisAI

Information disclosure and host-process Denial-of-Service affects VMware ESX, Workstation, and Fusion via an out-of-bounds read (CWE-125) reachable by an actor holding VM deployment privileges. On ESX the flaw can crash or leak memory from the host VMX process (a guest-to-host scope crossing), while on Workstation and Fusion the impact is limited to information disclosure. Reported by VMware/Broadcom with no public exploit identified at time of analysis and no CISA KEV listing.

Technical ContextAI

The vulnerability is an out-of-bounds read (CWE-125), where the hypervisor's device or data-handling code reads past the bounds of an allocated buffer, returning adjacent host-process memory or dereferencing invalid memory and crashing. The affected code runs in the per-VM host process (VMX/VMM) that emulates guest hardware, so a malformed input path triggered from a provisioned/deployed VM can reach host memory. Per the CPE data the same core virtualization stack is bundled across VMware ESX, Workstation, Fusion, VMware Cloud Foundation, vSphere Foundation, and Telco Cloud Platform, meaning the shared hypervisor component - not a single product - is the root affected technology.

RemediationAI

Apply the fixed builds published in the Broadcom/VMware security advisory (https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017) for each affected product line; exact fix versions are not included in the supplied data and must be taken from that advisory (Patch available per vendor advisory - released patched version not independently confirmed here). Until patched, reduce exposure by restricting VM deployment and provisioning privileges to a minimal set of trusted administrators (the PR:H prerequisite), tightening vCenter/ESX role-based access control so untrusted tenants cannot instantiate or configure VMs, and isolating management-plane access; the trade-off is reduced self-service provisioning agility. Monitor host processes (VMX) for unexpected crashes as an indicator of DoS attempts.