Description

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.14. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 5.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.6",
  "pubDate": "2026-08-18T21:18:16.167Z",
  "pubdate": "2026-08-18T21:18:16.167Z",
  "executiveSummary": "An information disclosure vulnerability affects the Core component of Oracle VM VirtualBox version 7.2.14, classified under virtualization infrastructure security.\nThe vulnerability allows a low-privileged local attacker with authenticated logon access to the underlying infrastructure where Oracle VM VirtualBox executes to compromise the application.\nSuccessful exploitation requires high attack complexity and local access, but results in a scope change that significantly impacts additional products by granting unauthorized access to critical data or complete access to all data accessible by Oracle VM VirtualBox.\nThe CVSS 3.1 base score is 5.6 with a vector of CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N, indicating sole impact to confidentiality without affecting integrity or availability.\nOrganizations operating the affected version face elevated risks of sensitive data exposure across the virtualization boundary, necessitating prompt security review and administrative hardening of host environments.",
  "technicalDetails": "The vulnerability resides within the Core component of Oracle VM VirtualBox version 7.2.14, specifically involving flaws in resource handling or privilege boundaries managed by the virtualization engine.\nExploitation requires the attacker to possess local interactive logon capabilities on the host infrastructure where the Oracle VM VirtualBox hypervisor or associated management services execute, meaning anonymous or remote unauthenticated exploitation is not feasible.\nThe attack vector is local (AV:L), and the attack complexity is rated as high (AC:H), implying that successful execution demands precise timing, specific race conditions, or specialized local environment configurations by the threat actor.\nThe attacker must authenticate with low privileges (PR:L) within the local environment before initiating the attack sequence, leveraging legitimate operating system interactions to interface with vulnerable internal virtualization APIs, IPC mechanisms, or shared memory structures.\nDue to the architectural design of hypervisors and virtual machine monitors, the vulnerability exhibits a scope change (S:C), meaning successful exploitation breaks out of the immediate security context of the initial component to impact secondary software products and resources residing on the host or adjacent guest management layers.\nDuring the attack flow, the malicious actor manipulates low-level core functions to bypass isolation controls, resulting in unauthorized read access to memory spaces or storage structures managed by VirtualBox.\nThe post-exploitation impact is strictly confined to confidentiality (C:H), yielding unauthorized access to critical data or complete extraction of all sensitive information accessible within the operational scope of Oracle VM VirtualBox, while integrity (I:N) and availability (A:N) remain uncompromised."
}