Description

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.14. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 6.0 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.0",
  "pubDate": "2026-08-18T21:18:14.310Z",
  "pubdate": "2026-08-18T21:18:14.310Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Core component of Oracle VM VirtualBox version 7.2.14, posing a direct threat to system availability. The vulnerability enables a highly privileged attacker who has successfully obtained interactive logon access to the underlying infrastructure hosting Oracle VM VirtualBox to compromise the virtualization software. Although the direct code execution context resides within Oracle VM VirtualBox, successful exploitation induces a scope change that significantly impacts the broader operational integrity of dependent or co-located infrastructure products. The primary technical impact resulting from successful exploitation is an unauthorized capability to induce a persistent application hang or a frequently repeatable system crash, culminating in a complete denial of service (DoS) for the affected virtualization environment. The associated CVSS 3.1 base score is 6.0, reflecting an availability-only impact with a vector of CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H. Exploitation requires local physical or logical access, low attack complexity, and high privileges, but does not require user interaction.",
  "technicalDetails": "The vulnerability resides in the Core component of Oracle VM VirtualBox version 7.2.14, specifically involving internal resource management, state validation, or exception handling mechanisms within the virtualization engine. The root cause stems from improper handling of state transitions or memory structures when manipulated by an attacker operating with elevated administrative or root privileges on the host infrastructure. Because the attack vector is local (AV:L), the adversary must first establish an interactive session on the host operating system where the Oracle VM VirtualBox hypervisor or associated management services execute. The attack complexity is rated as low (AC:L), indicating that no specialized race conditions or complex environmental setups are required to trigger the underlying flaw once the necessary privileges are acquired. Furthermore, user interaction is not required (UI:N), meaning the execution flow proceeds deterministically upon invocation by the privileged actor. To execute the attack, the threat actor leverages high privileges (PR:H) to interact directly with vulnerable internal APIs, device drivers, or core virtualization binaries exposed by Oracle VM VirtualBox. Upon supplying specially crafted inputs or issuing malicious control commands to the Core component, the attacker triggers an unhandled exception, infinite loop, or critical resource exhaustion state. This directly disrupts the execution thread or process space of the virtualization engine, leading immediately to an application hang or an abrupt, repeatable crash (complete DoS). The security scope is changed (S:C), signifying that the fault condition within Oracle VM VirtualBox propagates its operational impact beyond the immediate boundaries of the target component, potentially destabilizing the host platform or concurrently running virtual machines. Confidentiality and integrity metrics remain entirely unaffected (C:N, I:N), as the capability is strictly constrained to inducing an availability failure without allowing unauthorized data disclosure or arbitrary code execution."
}