Description

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.14. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-18T21:18:13.287Z",
  "pubdate": "2026-08-18T21:18:13.287Z",
  "executiveSummary": "A vulnerability affecting the Core component of Oracle VM VirtualBox version 7.2.14 allows an unauthenticated attacker with local logon access to compromise the targeted software. The flaw introduces risks related to integrity and availability impacts, specifically enabling unauthorized data modification and service disruption. Successful exploitation requires human interaction from an individual other than the attacker, where a user must interact with the application or malicious payload provided by the adversary. The inherent risks include complete denial of service conditions through application hangs or repeatable crashes, alongside unauthorized insert, update, or delete capabilities against accessible data within the VirtualBox boundary. With a CVSS 3.1 Base Score of 6.1, the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H indicates local attack vector execution with low complexity, requiring no initial privileges but depending heavily on user interaction. Remediation requires applying vendor-supplied updates or patches specific to version 7.2.14 to eliminate the underlying logic or memory handling flaws in the Core component.",
  "technicalDetails": "The vulnerability resides within the Core component of Oracle VM VirtualBox version 7.2.14, handling internal virtualization routines, resource management, or inter-process communication interfaces. The attack vector is classified as local (AV:L), meaning the adversary must already possess interactive logon capabilities to the underlying host infrastructure where Oracle VM VirtualBox executes. The attack complexity is low (AC:L), indicating that standard exploitation conditions are reliably met without requiring complex race conditions or specialized environmental manipulation. Furthermore, the vulnerability requires no privileges (PR:N), allowing any unauthenticated local user or process to initiate the attack vector provided that requisite user interaction (UI:R) is successfully elicited. During the attack flow, the adversary leverages local system access to position maliciously crafted inputs, files, or state triggers that are subsequently processed by the vulnerable VirtualBox Core component. Because human interaction is required, the attacker must trick a legitimate user or administrator into performing an action such as opening a specially crafted virtual machine configuration, attaching a malicious virtual medium, or interacting with a graphical user interface element managed by the vulnerable software. Upon processing the malicious input under the context of the user session, the vulnerable Core component encounters an unhandled exception, memory corruption, or logic error. This triggers a repeatable crash or application hang, resulting in a complete denial of service (A:H) condition for Oracle VM VirtualBox. Simultaneously, the flawed processing logic allows unauthorized modification, insertion, or deletion (I:L) of accessible data structures or configuration parameters managed by the application. The scope remains unchanged (S:U) as the impact is confined to the VirtualBox application boundary and its directly accessible data stores on the host. Confidentiality is not impacted (C:N), as unauthorized data read operations are not facilitated by this specific flaw. Technical remediation demands debugging or patching the affected Core parsing routines and memory management functions in version 7.2.14 to ensure rigorous input validation and exception handling."
}