Description

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.14. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 6.0 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.0",
  "pubDate": "2026-08-18T21:18:14.560Z",
  "pubdate": "2026-08-18T21:18:14.560Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Core component of Oracle VM VirtualBox version 7.2.14, specifically impacting availability. The vulnerability allows a highly privileged attacker with local logon access to the underlying infrastructure where Oracle VM VirtualBox executes to compromise the application. Successful exploitation of this flaw does not affect confidentiality or integrity but results in an unauthorized ability to cause a hang or frequently repeatable crash, leading to a complete Denial of Service (DoS) of the targeted virtualization software. Due to the architectural characteristics of virtualization layers, attacks targeting this vulnerability may significantly impact additional products, resulting in a formal scope change as defined by the CVSS 3.1 framework. The vulnerability carries a CVSS 3.1 Base Score of 6.0 with a vector string of CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H. Exploitation requires local physical or logical access to the host operating system, low attack complexity, and high privileges, but does not require user interaction. Organizations utilizing the affected version must restrict administrative privileges on virtualization hosts and apply vendor-supplied patches promptly upon release to mitigate potential availability disruptions.",
  "technicalDetails": "The vulnerability resides in the Core component of Oracle VM VirtualBox version 7.2.14, affecting how the virtualization layer processes internal state management, resource allocation, or execution logic. The root cause stems from insufficient validation or error handling within the core virtualization engine when interacting with host-level resources or receiving specific commands from authorized contexts. Because the attack vector is classified as local (AV:L), the adversary must already possess interactive logon capabilities on the infrastructure host where the VirtualBox hypervisor or associated management services execute. The exploitation requirements are characterized by low attack complexity (AC:L) and require high privileges (PR:H), meaning the threat actor must operate with administrative or elevated system privileges on the host operating system to interact with vulnerable internal APIs, driver interfaces, or core daemon processes. No user interaction (UI:N) is required for successful execution. The attack flow begins with the highly privileged attacker authenticating locally to the host infrastructure. The adversary then interacts with the vulnerable Core component of Oracle VM VirtualBox, leveraging administrative interfaces or local control channels to supply malformed inputs, trigger exceptional execution paths, or exhaust critical internal resources. Because the vulnerability involves a scope change (S:C), the impact extends beyond the immediate boundaries of the Oracle VM VirtualBox process, potentially destabilizing dependent hypervisor functions, management APIs, or co-hosted virtual machines running on the same infrastructure. The payload behavior does not involve arbitrary code execution, privilege escalation, or data exfiltration; instead, it triggers unhandled exceptions, infinite loops, deadlock conditions, or critical resource exhaustion within the virtualization runtime. Consequently, the post-exploitation impact is strictly localized to availability, resulting in an immediate hang or a frequently repeatable crash (complete DoS) of Oracle VM VirtualBox, rendering all hosted virtual machines inaccessible and disrupting enterprise virtualization operations."
}