Description

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.14. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-18T21:18:13.737Z",
  "pubdate": "2026-08-18T21:18:13.737Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Core component of Oracle VM VirtualBox version 7.2.14, presenting significant security risks to virtualized environments. This privilege escalation flaw enables a highly privileged attacker who has achieved local interactive logon access to the underlying infrastructure hosting Oracle VM VirtualBox to completely compromise the virtualization software. Successful exploitation yields a severe security impact, resulting in the absolute takeover of Oracle VM VirtualBox. Due to the architectural boundaries crossed during an attack, the vulnerability exhibits a scope change, meaning that successful exploitation can significantly impact additional co-located products and systems beyond the immediate virtualization boundary. The CVSS 3.1 base score is recorded at 8.2, reflecting high impacts across confidentiality, integrity, and availability vectors. Attack execution requires local physical or logical access to the host infrastructure alongside high administrative privileges, but no user interaction is necessitated to successfully execute malicious payloads or achieve full system compromise.",
  "technicalDetails": "The vulnerability resides natively within the Core component of Oracle VM VirtualBox version 7.2.14, specifically involving inadequate input validation, improper access control enforcement, or memory safety deficiencies during low-level hypervisor or host-guest operational handling. The attack surface is exposed locally on the underlying host operating system where the virtualization software executes. Although network exposure is absent due to the Local attack vector (AV:L), and low attack complexity (AC:L) ensures reliable execution conditions, exploitation strictly demands high privileges (PR:H) on the infrastructure layer, implying the threat actor must already possess administrative or root-level capabilities on the host OS prior to targeting the virtualization core.\nThe attack flow proceeds as follows: First, the authenticated threat actor establishes a local interactive session on the host machine executing Oracle VM VirtualBox. Second, leveraging their existing high privileges, the attacker interacts directly with vulnerable internal APIs, exposed inter-process communication channels, or privileged driver interfaces managed by the Core component. Third, the attacker submits specially crafted payloads designed to trigger memory corruption, logic flaws, or unauthorized state modifications within the VirtualBox runtime environment. Because the vulnerability features a scope change (S:C), the execution breaches standard security boundaries, allowing unauthorized control actions to propagate from the hypervisor core layer into adjacent architectural components and co-hosted guest or host infrastructure.\nThe resulting post-exploitation impact encompasses the total takeover of Oracle VM VirtualBox, leading to the complete loss of confidentiality, integrity, and availability (C:H/I:H/A:H) for both the hypervisor management plane and any virtual machines controlled by it. The absence of required user interaction (UI:N) ensures that the exploitation sequence executes deterministically without relying on social engineering or operator intervention."
}