CVE-2026-41703: 
VMware Workstation vulnerability analysis and mitigation

CVE-2026-41703 is an out-of-bounds read vulnerability (CWE-125) affecting VMware ESX, Workstation, and Fusion. A malicious actor with VM deployment privileges can trigger the flaw, potentially leading to information disclosure or, more likely, a Denial-of-Service (DoS) condition of the host process; on Workstation and Fusion, the impact is restricted to information disclosure. The vulnerability was privately reported to Broadcom and publicly disclosed on July 29, 2026, as part of security advisory VMSA-2026-0006. Affected products include VMware ESX 8.0 (before ESXi80U3i-25205845), ESX 9.0.x.x (before ESXi-9.0.2.0100-25595025), ESX 9.1.x.x (before ESXi-9.1.0.0-25370933), Workstation 25H2 (before 26H1), Fusion 25H2 (before 26H1), Cloud Foundation 5.x (before 5.2.3), and Telco Cloud Platform 5.0.x/5.1.x. The CVSSv3.1 base score is 7.6 (Important/High) for ESX deployments and 2.7 (Low) for Workstation and Fusion (Broadcom Advisory, GitHub Advisory).

The vulnerability is classified as CWE-125 (Out-of-bounds Read), mapped to CAPEC-540 (Overread Buffers). An attacker with VM deployment privileges can craft operations that cause the hypervisor to read memory beyond the intended buffer boundary, which may expose sensitive host memory contents or crash the host process. The attack vector is network-based with high privileges required and no user interaction needed, and the scope is changed (affecting the host from the guest context). No public technical write-up or proof-of-concept code has been identified at this time. The vulnerability was reported by Maxim Suhanov (@errno_fail) (Broadcom Advisory).

On VMware ESX, successful exploitation can result in high confidentiality impact (sensitive host memory disclosure) and low availability impact (DoS of the host process), with no integrity impact. On VMware Workstation and Fusion, the impact is limited to information disclosure only. Because the scope is changed, a compromised guest VM could affect the host hypervisor process, potentially exposing data from other VMs or the host environment, though no lateral movement or code execution capability has been identified for this specific vulnerability (Broadcom Advisory, GitHub Advisory).

There is no evidence of public proof-of-concept code or active in-the-wild exploitation of CVE-2026-41703 at this time. The EPSS score is approximately 0.556% (43rd percentile), indicating a relatively low near-term exploitation probability. The vulnerability requires high privileges (VM deployment privileges) to exploit, which limits the attacker pool. It has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory, Broadcom Advisory).

Broadcom has released patches for all affected products with no available workarounds. Administrators should apply the following fixed versions: VMware ESX 9.1.x.x → ESXi-9.1.0.0-25370933; ESX 9.0.x.x → ESXi-9.0.2.0100-25595025; ESX 8.0 → ESXi80U3i-25205845; Workstation 25H2 → 26H1; Fusion 25H2 → 26H1; Cloud Foundation 5.x → 5.2.3; Telco Cloud Platform 5.0.x/5.1.x → KB449886. As a compensating control, restrict VM deployment privileges to only trusted administrators and consider network segmentation to limit access to ESX management interfaces (Broadcom Advisory).

CVE-2026-41703 was disclosed as part of the broader VMSA-2026-0006 advisory, which also included two critical 9.8-scored vCenter authentication bypass vulnerabilities and a critical VM escape flaw (CVE-2026-47876), drawing significant media attention. Coverage from BleepingComputer, The Hacker News, SecurityWeek, and Security Affairs focused primarily on the more severe vulnerabilities in the same advisory, with CVE-2026-41703 receiving comparatively less individual attention due to its lower severity rating. Community discussion on Reddit's r/sysadmin noted the urgency of patching the full advisory bundle. One commentary piece highlighted that the 2.7-scored vulnerabilities in the same advisory were being overshadowed by the critical flaws, but still warranted patching (BleepingComputer, The Hacker News, SecurityWeek).