Description

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.14. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.4",
  "pubDate": "2026-08-18T21:18:14.790Z",
  "pubdate": "2026-08-18T21:18:14.790Z",
  "executiveSummary": "A vulnerability has been identified within the Core component of Oracle VM VirtualBox, specifically affecting version 7.2.14. This vulnerability presents an availability risk to the virtualization infrastructure, allowing an authenticated attacker to disrupt operations.\nThe vulnerability is classified as easily exploitable, requiring no user interaction, but necessitates high-privileged access to the underlying infrastructure where Oracle VM VirtualBox executes. Successful exploitation of this flaw leads to the unauthorized capability to cause a hang or a frequently repeatable crash, resulting in a complete Denial of Service (DoS) of the Oracle VM VirtualBox product.\nThe CVSS 3.1 Base Score is 4.4, with impacts strictly confined to the availability vector (AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Confidentiality and integrity metrics remain unaffected. Risk implications are centered around operational disruption and potential service downtime for virtualized environments managed by the affected VirtualBox instance.\nOrganizations running the specified vulnerable version must evaluate the threat landscape, particularly concerning local system access, and implement appropriate security controls to mitigate potential availability disruptions.",
  "technicalDetails": "The vulnerability resides in the Core component of Oracle VM VirtualBox version 7.2.14. The root cause stems from improper handling of specific internal operations or resource management requests processed by the virtualization core, leading to instability when triggered under specific execution conditions.\nExploitation of this vulnerability requires local access (AV:L), meaning the attacker must already possess a foothold on the host operating system or infrastructure where Oracle VM VirtualBox is actively executing. The attack complexity is rated as low (AC:L), indicating that no specialized race conditions or complex environmental setups are required to achieve the desired outcome once access is established.\nA prerequisite for successful exploitation is the possession of high privileges (PR:H) on the host system. This ensures that the attacker can interact directly with privileged system components, administrative interfaces, or internal APIs exposed by the VirtualBox Core component.\nThe attack flow proceeds as follows: First, the high-privileged attacker authenticates locally to the infrastructure hosting the targeted Oracle VM VirtualBox process. Second, the attacker leverages their administrative privileges to interact with the vulnerable Core component, passing maliciously crafted inputs or triggering resource exhaustion states designed to destabilize the execution flow. Third, the unhandled exception, deadlock, or resource fault manifests within the Core processing logic, causing the application to hang or fault.\nThe payload behavior is focused exclusively on disrupting system availability. Upon successful execution of the attack vector, the Oracle VM VirtualBox process encounters a fatal condition leading to a complete Denial of Service (DoS). The crash is frequently repeatable, posing a persistent threat to service uptime if automated recovery or stability patches are absent.\nPost-exploitation impact is limited to availability degradation. The vulnerability does not provide mechanisms for lateral movement, privilege escalation, or unauthorized access to sensitive data (Confidentiality: None, Integrity: None). However, repeated invocation of the crash condition can severely impact dependent virtual machines and hosted services relying on the affected Oracle VM VirtualBox instance."
}