What’s Vulnerable › Vulnerabilities
CVE-2026-41703: Out-of-bounds read vulnerability
- Severity: high (CVSS 7.6 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-07-30 · updated 2026-07-30
- Weakness: CWE-125
Description
VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability. A malicious actor with VM deployment privileges could trigger an out-of-bounds read, potentially leading to information disclosure or more likely a Denial-of-Service (DoS) condition of the host process. On Workstation and Fusion, the impact of this vulnerability is restricted to information disclosure.
Affected products
- VMware Cloud Foundation: from 5.x before 5.2.3; 9.1.x.x, 9.0.x.x — fixed in 5.2.3
- VMware ESX: from 9.1.x.x before ESXi-9.1.0.0-25370933; from 9.0.x.x before ESXi-9.0.2.0100-25595025; from 8.0 before ESXi80U3i-25205845 — fixed in ESXi-9.0.2.0100-25595025, ESXi-9.1.0.0-25370933, ESXi80U3i-25205845
- VMware Fusion: from 25H2 before 26H1 — fixed in 26H1
- VMware Telco Cloud Platform: 5.1.x, 5.0.x
- VMware vSphere Foundation: 9.1.x.x, 9.0.x.x
- VMware Workstation: from 25H2 before 26H1 — fixed in 26H1
How to fix
Upgrade to a fixed version: VMware Cloud Foundation 5.2.3; VMware ESX ESXi-9.0.2.0100-25595025, ESXi-9.1.0.0-25370933, ESXi80U3i-25205845; VMware Fusion 26H1; VMware Workstation 26H1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-41703 or the next vulnerability affects your stack