VMware ESX 8.0 / 9.0 / 9.1 Out-of-Bounds Read (VMSA-2026-0006)

high Nessus Plugin ID 337682

Synopsis

The VMware ESX host is affected by an out-of-bounds read vulnerability.

Description

The version of VMware ESX installed on the remote host is 8.0 prior to build 25205845 (8.0 Update 3i), or 9.0 prior to build 25595025 (9.0.2.0100), or 9.1 prior to build 25370933 (9.1.0.0). It is, therefore, affected by a vulnerability as referenced in the VMSA-2026-0006.1 advisory:

- VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability. A malicious actor with VM deployment privileges could trigger an out-of-bounds read, potentially leading to information disclosure or more likely a Denial-of-Service (DoS) condition of the host process. On Workstation and Fusion, the impact of this vulnerability is restricted to information disclosure. (CVE-2026-41703)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Apply the relevant patch referenced in the VMSA-2026-0006.1 advisory.

Plugin Details

Severity: High

ID: 337682

File Name: vmware_esxi_vmsa-2026-0006_CVE-2026-41703.nasl

Version: 1.1

Type: Remote

Family: Misc.

Published: 8/18/2026

Updated: 8/18/2026

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.6

Percentile: 96.74

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Vector: CVSS2#AV:N/AC:L/Au:M/C:C/I:N/A:P

CVSS Score Source: CVE-2026-41703

CVSS v3

Risk Factor: High

Base Score: 7.6

Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Vulnerability Information

CPE: cpe:/o:vmware:esxi

Required KB Items: Host/VMware/release, Host/VMware/version, Host/VMware/vsphere

Patch Publication Date: 7/29/2026

Vulnerability Publication Date: 7/29/2026

Reference Information

CVE: CVE-2026-41703

VMSA: 2026-0006

Detections

Analytics