Vulnerability Intelligence Report
Out-of-bounds read vulnerability
CVE-2026-41703
VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability. A malicious actor with VM deployment privileges could trigger an out-of-bounds read, potentially leading to information disclosure or more likely a Denial-of-Service (DoS) condition of the host process. On Workstation and Fusion, the impact of this vulnerability is restricted to information disclosure.
No Active Exploit Signals
CVSS Base Score
7.6
HIGH
Exploitability:2.3
Impact Score:4.8
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-125 ↗CWE-125 Out-of-bounds read
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| VMware | Cloud Foundation | 9.1.x.x (affected), 9.0.x.x (affected), 5.x < 5.2.3 (affected) |
| VMware | vSphere Foundation | 9.1.x.x (affected), 9.0.x.x (affected) |
| VMware | ESX | 9.1.x.x < ESXi-9.1.0.0-25370933 (affected), 9.0.x.x < ESXi-9.0.2.0100-25595025 (affected), 8.0 < ESXi80U3i-25205845 (affected) |
| VMware | Workstation | 25H2 < 26H1 (affected) |
| VMware | Fusion | 25H2 < 26H1 (affected) |
| VMware | Telco Cloud Platform | 5.1.x (affected), 5.0.x (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | VMware by Broadcom · Vendor · USA |
| Reserved | 2026-04-22T06:21:22 |
| Published | 2026-07-30T12:39:02 |
| Patch Date | 2026-07-29 |
| Last Updated | 2026-07-30T15:09:25 |
Community Chatter & Buzz