CVE-2026-41703: VMware Cloud Foundation

High severity, CVSS 7.6. EPSS: 0.4% chance of exploitation in the next 30 days.

VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability. A malicious actor with VM deployment privileges could trigger an out-of-bounds read, potentially leading to information disclosure or more likely a Denial-of-Service (DoS) condition of the host process. On Workstation and Fusion, the impact of this vulnerability is restricted to information disclosure.

Affected products

• VMware Cloud Foundation: version 9.1.x.x only; version 9.0.x.x only; from 5, before 5.2.3 (fixed in 5.2.3)
• VMware Esx
• VMware Fusion: from 25H2, before 26H1 (fixed in 26H1)
• VMware Telco Cloud Platform: from 5.1, before 5.2 (fixed in 5.2); from 5.0, before 5.1 (fixed in 5.1)
• VMware Vsphere Foundation: version 9.1.x.x only; version 9.0.x.x only
• VMware Workstation: from 25H2, before 26H1 (fixed in 26H1)

Published 2026-07-30. Last modified 2026-07-30.