Description

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.14. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data as well as unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 3.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.4",
  "pubDate": "2026-08-18T21:18:14.903Z",
  "pubdate": "2026-08-18T21:18:14.903Z",
  "executiveSummary": "An exploitable vulnerability exists within the Core component of Oracle VM VirtualBox version 7.2.14, specifically residing in the virtualization infrastructure execution layer. This security flaw enables a highly privileged local attacker to compromise the integrity and confidentiality of the targeted virtualization software. Successful exploitation does not yield complete system takeover or cause availability disruption, but it does grant unauthorized read, update, insert, and delete access to a specific subset of data accessible by Oracle VM VirtualBox. The vulnerability carries a CVSS 3.1 Base Score of 3.4, highlighting a low severity threat profile that nonetheless breaches data confidentiality and integrity boundaries within the virtualization environment.\nThe attack vector is strictly local, requiring the threat actor to have obtained high-level privileges and valid logon access to the underlying infrastructure where Oracle VM VirtualBox executes. Interaction from a user is not required to facilitate the attack. Due to the high privilege prerequisites, the risk implications are largely mitigated in environments where host-level access controls and least-privilege administrative principles are rigorously enforced. However, successful exploitation allows an attacker who has already breached the host infrastructure to manipulate or exfiltrate sensitive data managed or accessed by the VirtualBox core engine, potentially leading to further compromise of virtualized assets or stored operational data.",
  "technicalDetails": "The vulnerability resides within the Core component of Oracle VM VirtualBox version 7.2.14, handling foundational virtualization operations and hypervisor-to-host resource management. The root cause stems from insufficient access controls, improper input validation, or inadequate boundary enforcement within internal data handling routines exposed by the core virtualization engine. Although specific source functions or internal file paths are not detailed in the advisory, the vulnerability manifests when processing administrative requests or managing state data within the virtualization infrastructure.\nExploitation of this flaw requires an attacker to possess high privileges (PR:H) and interactive or programmatic logon capabilities (AV:L) to the host operating system or infrastructure layer executing Oracle VM VirtualBox. The attack complexity is low (AC:L), meaning no sophisticated race conditions or complex exploitation chains are required once the prerequisite privileges are established. Furthermore, user interaction is not required (UI:N) for the attack to succeed, and the scope remains unchanged (S:U), restricting the direct impact to the vulnerable component itself rather than cascading across distinct security domains.\nThe attack flow proceeds as follows: First, the threat actor authenticates to the underlying host infrastructure with high privileges, such as administrative or root-level access. Second, the attacker interacts with the Oracle VM VirtualBox Core component via local management interfaces, APIs, or internal command channels. Third, by supplying specially crafted inputs or leveraging insecure administrative routines, the attacker bypasses intended data access restrictions. Finally, the payload or command execution results in unauthorized read access to a subset of VirtualBox-accessible data, as well as unauthorized update, insert, or delete capabilities against targeted data structures. The post-exploitation impact is strictly confined to data confidentiality and integrity violations (C:L/I:L), with availability remaining unaffected (A:N)."
}