This vulnerability (CVE-2026-41703) involves an out-of-bounds read (CWE-125) in VMware ESX, Workstation, and Fusion products. An attacker with VM deployment privileges can trigger this flaw, potentially causing information disclosure or denial-of-service conditions. The CVSS 3.1 base score is 7.6, indicating high severity, with network attack vector, low attack complexity, high privileges required, no user interaction, and scope change. The vulnerability affects VMware Cloud Foundation versions 5.x, 9.0.x.x, and 9.1.x.x. No vendor advisory or patch is currently available, and no known exploits are reported in the wild.

Successful exploitation can lead to information disclosure on Workstation and Fusion products. On VMware ESX, the impact is more severe, potentially causing a denial-of-service condition of the host process. There is no indication of integrity or availability impacts beyond DoS, and no known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is available, users should monitor VMware advisories for updates. Restricting VM deployment privileges to trusted administrators may reduce risk.