Description

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.14. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 6.0 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.0",
  "pubDate": "2026-08-18T21:18:13.623Z",
  "pubdate": "2026-08-18T21:18:13.623Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Core component of Oracle VM VirtualBox version 7.2.14, specifically impacting availability. The flaw allows a highly privileged local attacker with direct logon access to the underlying infrastructure hosting the virtualization software to compromise the application. Successful exploitation of this vulnerability results in an unauthorized ability to cause a hang or a frequently repeatable crash, leading to a complete denial of service (DoS) state for Oracle VM VirtualBox.\nThe vulnerability carries a CVSS 3.1 Base Score of 6.0 with a vector of CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H, reflecting the significant scope change where attacks on the virtualization core can negatively impact additional products and infrastructure components running in conjunction with the hypervisor. Exploitation requires no user interaction and relies on low attack complexity, although it strictly necessitates high privileges on the host system. Organizations utilizing the affected version face operational availability risks if administrative boundaries on the host infrastructure are compromised.",
  "technicalDetails": "The vulnerability resides in the Core component of Oracle VM VirtualBox version 7.2.14, affecting the hypervisor's internal management and execution routines. The root cause stems from improper handling of specific administrative operations or resource management requests processed by the core virtualization engine, leading to exception conditions that the application fails to handle gracefully.\nThe attack vector is local (AV:L), meaning the malicious actor must already have local interactive logon access to the host operating system or infrastructure where Oracle VM VirtualBox executes. The attack complexity is low (AC:L), requiring minimal technical hurdles to trigger the flawed code path once access is obtained. However, the prerequisite privilege level is high (PR:H), mandating that the attacker possesses administrative or equivalent elevated rights on the host system prior to initiating the attack.\nThe step-by-step attack flow begins with the highly privileged attacker establishing a session on the host infrastructure. The attacker interacts with the vulnerable Core component of Oracle VM VirtualBox, potentially through administrative interfaces, command-line utilities, or privileged application programming interfaces. By supplying malformed inputs, invoking unsafe state transitions, or exhausting critical internal resources managed by the core engine, the attacker triggers an unhandled exception or deadlock condition.\nBecause the vulnerability exhibits a scope change (S:C), the crash or hang does not merely terminate an isolated guest virtual machine instance; it destabilizes the core virtualization process itself. This causes the entire Oracle VM VirtualBox application to hang or crash repeatedly, resulting in a complete denial of service (Complete DoS). Consequently, any dependent services, co-hosted virtual machines, or management planes relying on the hypervisor are severely impacted, leading to cascading operational failures across the broader virtualization environment.\nThe payload behavior is strictly destructive to system availability, resulting in process termination or infinite wait states. Confidentiality and integrity impacts are none (C:N, I:N), as the vulnerability cannot be leveraged to read arbitrary memory or modify system files. No user interaction (UI:N) is required to facilitate the crash once the privileged inputs or triggers are executed."
}