CVE-2026-41703
High
Description
VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability. A malicious actor with VM deployment privileges could trigger an out-of-bounds read, potentially leading to information disclosure or more likely a Denial-of-Service (DoS) condition of the host process. On Workstation and Fusion, the impact of this vulnerability is restricted to information disclosure.
SeverityHigh
CVSS7.6
Exploit probability—
Product
Workstation
PublishedJul 30, 2026
First seenJul 30, 2026
Weakness typeCWE-125Out-of-bounds read
How to fix
Update
- VMware Workstation26H1 or later
- VMware Cloud Foundation5.2.3 or later
- VMware ESXESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, ESXi80U3i-25205845 or later
- VMware Fusion26H1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| VMware Workstation | 25H2 ≤ v < 26H1 | 26H1 |
| VMware Cloud Foundation | 9.1.x.x, 9.0.x.x, 5.x ≤ v < 5.2.3 | 5.2.3 |
| VMware vSphere Foundation | 9.1.x.x, 9.0.x.x | — |
| VMware ESX | 9.1.x.x ≤ v < ESXi-9.1.0.0-25370933, 9.0.x.x ≤ v < ESXi-9.0.2.0100-25595025, 8.0 ≤ v < ESXi80U3i-25205845 | ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, ESXi80U3i-25205845 |
| VMware Fusion | 25H2 ≤ v < 26H1 | 26H1 |
| VMware Telco Cloud Platform | 5.1.x, 5.0.x | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.