Root Access Race: TOCTOU Vulnerability (CVE-2026-41702) Hits VMware Fusion

Broadcom has recently issued a critical alert and accompanying patches for VMware Fusion, addressing a local privilege escalation vulnerability that exploits a split-second lapse in the software’s defensive logic.

The flaw, designated as CVE-2026-41702, centers on a classic but potent architectural error known as a TOCTOU (Time-of-check Time-of-use) vulnerability. This specific weakness manifests during operations performed by a SETUID binary within the Fusion environment.

A TOCTOU vulnerability occurs when a program checks a particular condition (such as file permissions) but, before it can act upon that check, an adversary intervenes to alter the state of the system.

In the context of VMware Fusion, a malicious actor must already possess local, non-administrative access to the system. By winning this “race condition,” the attacker can manipulate the process to execute commands with elevated authority.

Successful exploitation allows the attacker to escalate their privileges to root, granting them absolute dominion over the host machine.

Broadcom’s security teams have categorized this issue within the Important severity range, assigning it a CVSSv3 base score of 7.8. While the attack requires local access—meaning a remote hacker cannot trigger this over the internet without first gaining a foothold—the potential for a total system takeover makes it a high-priority concern for enterprise environments and individual power users alike.

The vulnerability impacts VMware Fusion version 25H2 across all supported platforms. Broadcom has moved swiftly to close this window of opportunity, providing a definitive fix in the latest release.

Users are strongly encouraged to transition to version 26H1 immediately to mitigate the risk of local escalation.