Oracle VM VirtualBox CVE-2025-61759

Exploitation requires the attacker to already hold a low-privileged, authenticated local logon (PR:L, AV:L) on the infrastructure where Oracle VM VirtualBox executes - this is a local privilege/data-access flaw in the VirtualBox Core component, not a remote one. Affected versions are specifically 7.1.12 and 7.2.2. The key limiting factors are: no network vector (an attacker cannot reach it remotely without first gaining local host access), required valid low-level credentials, and no user interaction needed once that access exists. Impact is confidentiality-only (C:H, I:N, A:N), so the flaw enables unauthorized reading of data - including data reachable via the scope change into the host or other products - but not data modification or denial of service.

This is a moderate-priority issue that does not rise to an urgent, drop-everything patch for most environments. The multiple signals are internally consistent: the CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, base 6.5) describes an attacker who already has local logon with low privileges on the host where VirtualBox runs, exploiting a privilege-management flaw (CWE-269) to gain confidentiality-only impact that crosses a scope boundary into additional products (e.g. the host or other guests). The EPSS score of 0.19% (8th percentile) reinforces low near-term exploitation likelihood, and the vulnerability is NOT on the CISA KEV list and has no public exploit identified at time of analysis - so there is no evidence of active exploitation or weaponization. The requirement for pre-existing local, authenticated access (PR:L, AV:L) is the dominant risk-limiting factor: this is a post-compromise escalation/data-disclosure primitive, not a remotely reachable entry point. No SSVC decision data was provided in the input. One tension worth verifying: the input Tags include 'Authentication Bypass,' which is inconsistent with a CVSS vector that explicitly requires low privileges (PR:L) and with the CWE-269 (Improper Privilege Management) classification - treat the 'Authentication Bypass' characterization with caution, as it is not supported by the CVSS metrics.

A low-privileged local user (or a user who controls a VirtualBox guest) who already has logon access to the host abuses an improper privilege-management flaw in the VirtualBox Core component to read data they should not be able to access, with the impact crossing into the host or other products due to the scope change. No public exploit code is identified at the time of analysis, and the attacker must already possess valid low-privilege local access before exploitation can begin.