https://exploit-intel.com/blog/tags/cwe-367/EIP research articles tagged cwe-367.en-usSun, 17 May 2026 10:31:46 -0400https://exploit-intel.com/blog/posts/cve-2026-41702-vmware-fusion-cnxtmp-symlink-race/https://exploit-intel.com/blog/posts/cve-2026-41702-vmware-fusion-cnxtmp-symlink-race/A TOCTOU race in VMware Fusion 25's vmx-apple binary that turns booting a VM into arbitrary chown, then arbitrary chown into a passwordless root shell via PAM injection. World-writable sticky directory, SUID-root callee, bind() and chown() both following symlinks, a 5-15 microsecond window between them. Full LPE chain in 40 seconds, single VM boot. The interesting part is what made it reliable.Sun, 17 May 2026 10:31:46 -0400