Description

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.14. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-18T21:18:13.400Z",
  "pubdate": "2026-08-18T21:18:13.400Z",
  "executiveSummary": "A vulnerability has been identified in the Core component of Oracle VM VirtualBox version 7.2.14, affecting Oracle Virtualization.\nThe vulnerability is difficult to exploit but allows a low-privileged attacker with local logon access to the underlying infrastructure where Oracle VM VirtualBox executes to achieve a complete compromise of the application.\nAlthough the flaw resides within Oracle VM VirtualBox, successful exploitation triggers a scope change, potentially leading to significant security impacts on additional products and environments beyond the immediate hypervisor boundary.\nSuccessful exploitation results in the complete takeover of Oracle VM VirtualBox, conferring high impacts across all three components of the CIA triad: Confidentiality, Integrity, and Availability.\nThe assigned CVSS 3.1 base score is 7.8, reflecting the severity of the potential host and guest infrastructure compromise.\nAttack requirements mandate that the adversary possesses local access with low privileges to the host operating system or infrastructure layer, alongside high attack complexity prerequisites.",
  "technicalDetails": "The vulnerability exists within the Core component of Oracle VM VirtualBox version 7.2.14, functioning as the central virtualization engine responsible for managing guest execution, hardware emulation, and hypervisor-to-host interactions.\nThe attack vector is local (AV:L), meaning the adversary must already have established an interactive logon session on the physical or virtual infrastructure host hosting the Oracle VM VirtualBox execution environment.\nThe attack complexity is rated as high (AC:H), indicating that successful exploitation likely requires specific race conditions, memory corruption prerequisites, precise timing, or specialized configurations to reliably trigger the underlying flaw.\nPrivilege requirements are low (PR:L), signifying that standard, unprivileged user accounts provisioned on the host infrastructure possess sufficient authorization to initiate the attack sequence.\nUser interaction is not required (UI:N), allowing the exploit to proceed autonomously once the attacker executes the necessary local payload.\nA critical characteristic of this vulnerability is the scope change (S:C), denoting that the consequences of a successful exploit extend beyond the immediate security boundaries of the vulnerable Oracle VM VirtualBox process, compromising secondary resources or adjacent virtualization layers.\nThe attack flow proceeds as follows: First, the low-privileged attacker authenticates locally to the infrastructure host. Second, leveraging local execution privileges, the attacker interacts with the vulnerable Core component of Oracle VM VirtualBox 7.2.14, potentially utilizing crafted inter-process communication, malicious API calls, or manipulated shared resources. Third, overcoming the high attack complexity constraints, the adversary triggers a memory safety or logic flaw within the virtualization engine. Finally, the exploitation yields unauthorized control over the VirtualBox process, allowing the attacker to escalate privileges, manipulate virtual machine states, escape the virtualization sandbox, or impact the broader infrastructure, resulting in total takeover.\nThe post-exploitation impact encompasses full confidentiality breach of guest and host data, integrity violations via unauthorized modifications to virtual environments, and availability disruption through service crashes or resource hijacking."
}