Review reviewHigh

CVE-2026-41703

VMware Cloud Foundation, vSphere Foundation, ESX

VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability. A malicious actor with VM deployment privileges could trigger an out-of-bounds read, potentially leading to information disclosure or more likely a Denial-of-Service (DoS) condition of the host process. On Workstation and Fusion, the impact of this vulnerability is restricted to information disclosure.

CVSS: 7.6
EPSS: 0.56%
CISA KEV: Not listed
Published: 2026.07.30

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.56%

Technical severityCVSS 7.6

Vulnerability overview

Affected product and versions

Product: VMware Cloud Foundation, vSphere Foundation, ESX
Affected versions: >= 9.1.x.x, >= 9.0.x.x, >= 5.x < 5.2.3, >= 9.1.x.x < ESXi-9.1.0.0-25370933, >= 9.0.x.x < ESXi-9.0.2.0100-25595025, >= 8.0 < ESXi80U3i-25205845, >= 25H2 < 26H1, >= 5.1.x, >= 5.0.x
Fixed versions: No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that VMware Cloud Foundation, vSphere Foundation, ESX and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
CWE: CWE-125