VMware Fusion TOCTOU local privilege escalation vulnerability
At a glance
Severity
MEDIUM 6.7
EPSS
EPSS 0.13 % · percentile 3 (2026-10-27)
State
PUBLISHED
Published
Updated
Assigner
vmware
NVD status
Modified
Description
VMware Fusion(13.x prior to 13.5) contains a TOCTOU (Time-of-check Time-of-use)
vulnerability that occurs during installation for the first time (the
user needs to drag or copy the application to a folder from the '.dmg'
volume) or when installing an upgrade. A malicious actor with local non-administrative user privileges may
exploit this vulnerability to escalate privileges to root on the system
where Fusion is installed or being installed for the first time.
