Description

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.14. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 6.0 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.0",
  "pubDate": "2026-08-18T21:18:13.510Z",
  "pubdate": "2026-08-18T21:18:13.510Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Core component of Oracle VM VirtualBox version 7.2.14, which can be leveraged by a highly privileged attacker to compromise the virtualization software.\nThe vulnerability allows an authenticated attacker with local logon access to the underlying infrastructure where Oracle VM VirtualBox executes to trigger a complete denial of service.\nSuccessful exploitation of this flaw results in unauthorized ability to cause a hang or frequently repeatable crash of the Oracle VM VirtualBox product, directly impacting system availability.\nAlthough the vulnerable code resides entirely within Oracle VM VirtualBox, the attack vector exhibits a scope change, meaning that successful exploitation may significantly impact additional collocated products or the wider virtualization environment.\nThe CVSS 3.1 base score is 6.0, driven exclusively by high availability impacts, while confidentiality and integrity metrics remain unaffected.\nPrerequisites for a successful attack include local physical or logical access to the host infrastructure, local logon capabilities, and high-level privileges within the execution environment, with no user interaction required.",
  "technicalDetails": "The vulnerability resides in the Core component of Oracle VM VirtualBox, specifically affecting version 7.2.14 of the virtualization software suite.\nAttack execution requires the threat actor to possess high privileges and local logon access to the host operating system or infrastructure layer where the Oracle VM VirtualBox hypervisor and management processes execute.\nDue to the local attack vector and low attack complexity, an attacker with elevated local privileges can interact directly with vulnerable internal hypervisor interfaces, APIs, or core driver components without encountering significant barriers.\nThe step-by-step attack flow begins with the privileged attacker establishing a local authenticated session on the host infrastructure executing Oracle VM VirtualBox.\nOnce the session is secured with high-level privileges, the attacker interacts with the vulnerable Oracle VM VirtualBox Core component by supplying specially crafted inputs, executing unauthorized control operations, or exhausting critical internal resources managed by the core hypervisor engine.\nThis malicious interaction induces an unhandled exception, infinite loop, or critical resource starvation within the core execution threads of Oracle VM VirtualBox.\nThe payload behavior manifests as a complete denial of service, characterized by a persistent application hang or a frequently repeatable application crash.\nBecause the vulnerability features a scope change, the destabilization of Oracle VM VirtualBox can cascade beyond the immediate virtualization boundary, severely impacting ancillary services, dependent virtual machines, or additional management products executing on the same infrastructure.\nNetwork exposure is absent, as the vulnerability cannot be exploited remotely; it strictly requires local access with high privileges.\nPost-exploitation impact is concentrated on availability degradation, preventing legitimate users and administrative entities from utilizing the virtualization platform until manual service recovery or host remediation is performed."
}