Vulnerabilities · 169 days ago
VMware Fusion is one local foothold away from full host control. A non-admin account on the Mac running Fusion can turn a limited compromise into root on the system, so the problem is not contained inside the guest VM.
Broadcom patched CVE-2026-41702, a time-of-check time-of-use flaw in a SETUID binary, in a VMware Fusion update. The vendor says the bug was reported by Mathieu Farrell and does not say it is being exploited in the wild.
The timing matters because Broadcom is at Pwn2Own Berlin and says more VMware fixes may follow. That points to continued pressure on VMware products, but this advisory itself is a patch notice, not an exploitation report.
1 source covering this story
High-Severity Vulnerability Patched in VMware Fusion
The patch was announced as Broadcom is attending the Pwn2Own hacking competition in Berlin this week.
Part of the PlainSec briefing for 2026-05-14