Description

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via RDP to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-18T21:18:11.870Z",
  "pubdate": "2026-08-18T21:18:11.870Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Core component of the Oracle VM VirtualBox product of Oracle Virtualization, specifically affecting version 7.2.14. This network-based security flaw allows an unauthenticated remote attacker to compromise the target hypervisor environment without requiring user interaction or prior privileges.\nThe primary risk implication of this vulnerability is the complete loss of availability for the affected Oracle VM VirtualBox instance. Successful exploitation enables an unauthorized malicious actor to induce a system hang or a frequently repeatable application crash, effectively causing a total denial of service (DoS) condition.\nThe Common Vulnerability Scoring System (CVSS) 3.1 assigns this issue a base score of 7.5, reflecting its exclusive impact on availability (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Because the attack vector relies on network access via the Remote Desktop Protocol (RDP), any system exposing the VirtualBox RDP interface to untrusted networks is at significant risk of remote disruption.",
  "technicalDetails": "The vulnerability resides in the Core component of Oracle VM VirtualBox version 7.2.14, specifically handling incoming network traffic processed via the Remote Desktop Protocol (RDP). The root cause stems from improper input validation or resource management within the RDP server implementation bundled inside the virtualization software.\nExploitation of this vulnerability requires network access to the target instance via the RDP protocol. The attack vector is classified as network-adjacent or network-accessible (AV:N), with a low attack complexity (AC:L) because it does not require specialized conditions or configurations beyond standard connectivity to the service. Furthermore, the vulnerability can be triggered entirely by unauthenticated attackers (PR:N) and requires zero user interaction (UI:N).\nThe attack flow proceeds as follows: First, the remote attacker establishes a standard network connection to the RDP listener exposed by the vulnerable Oracle VM VirtualBox instance. Second, the attacker transmits a specially crafted sequence of RDP protocol messages designed to trigger the underlying logic flaw within the Core component. Third, upon processing the malicious payload, the application encounters an unhandled exception, infinite loop, or severe resource exhaustion condition.\nThis behavior directly results in the unauthorized ability to cause a hang or a frequently repeatable crash of the Oracle VM VirtualBox process. The post-exploitation impact is limited to availability, manifesting as a complete denial of service (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), terminating virtual machine operations and potentially disrupting dependent services hosted on the hypervisor."
}