Description

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.14. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data as well as unauthorized read access to a subset of Oracle VM VirtualBox accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 5.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.7",
  "pubDate": "2026-08-18T21:18:14.197Z",
  "pubdate": "2026-08-18T21:18:14.197Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Core component of Oracle VM VirtualBox version 7.2.14, classified as a local privilege and access control deficiency.\nThe vulnerability allows a highly privileged attacker with direct logon access to the underlying infrastructure where Oracle VM VirtualBox executes to successfully compromise the virtualization software.\nAlthough the flaw resides directly within Oracle VM VirtualBox, successful exploitation introduces a scope change, meaning attacks can significantly impact additional co-located products and system resources outside the immediate boundaries of the hypervisor.\nThe compromise grants the adversary unauthorized capabilities, including the execution of unauthorized updates, insertions, or deletions of accessible data, unauthorized read access to a subset of sensitive data, and the ability to trigger a partial denial of service condition affecting the availability of Oracle VM VirtualBox.\nWith a CVSS 3.1 Base Score of 5.7, the risk implications highlight a moderate severity threat vector characterized by low attack complexity and local network exposure.\nPrerequisites for a successful attack mandate that the threat actor already possesses high privileges and valid logon credentials to the host infrastructure, limiting remote exploitation vectors while underscoring the critical necessity of rigorous host-level access controls and least-privilege enforcement.",
  "technicalDetails": "The vulnerability resides in the Core component of Oracle VM VirtualBox version 7.2.14, specifically involving inadequate handling of internal operations and access boundaries between the virtualization layer and the host operating system.\nAttack execution requires the adversary to possess high privileges and interactive or programmatic logon capabilities to the underlying infrastructure hosting the Oracle VM VirtualBox execution environment.\nThe attack flow initiates when the authenticated, highly privileged attacker interacts locally with the vulnerable Core component of Oracle VM VirtualBox, leveraging their existing elevated standing on the host system.\nDue to improper validation or enforcement of operational parameters within the Core component, the attacker bypasses internal access controls, enabling unauthorized interactions with the virtualization engine's data structures and operational execution threads.\nThe scope change (S:C) metric indicates that the vulnerability permits the attacker to break out of the initial security context of Oracle VM VirtualBox, exerting cascading impacts on supplementary products and shared resources managed by the infrastructure.\nPost-exploitation impacts manifest across three security dimensions: confidentiality is compromised through unauthorized read access to a subset of data accessible by Oracle VM VirtualBox; integrity is violated via unauthorized update, insert, and delete operations on application data; and availability is impaired through actions that induce a partial denial of service condition, disrupting normal hypervisor operations.\nThe attack vector is strictly local (AV:L), with low attack complexity (AC:L), requiring no user interaction (UI:N), but strictly mandating high privileges (PR:H) on the host system to initiate the sequence."
}