Oracle VM VirtualBox CVE-2025-61760

Requires a local, authenticated low-privileged account (PR:L, AV:L) on the system where VirtualBox runs - remote exploitation is not possible. Exploitation is further gated by three limiting factors: high attack complexity (AC:H) meaning the attacker must win specific timing/state or configuration conditions that are not reliably reproducible; and mandatory interaction from a different person (UI:R), such as a legitimate user starting or operating a VM. The payoff is a scope change (S:C): the flaw resides in the VirtualBox Core but a successful escape significantly impacts the surrounding host/additional products with full confidentiality, integrity, and availability loss. Affected builds are specifically 7.1.12 and 7.2.2; other versions are not listed as affected.

This is a defense-in-depth / access-control flaw (CWE-284) in the VirtualBox Core, and the available signals converge on a genuine-but-not-urgent priority. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:R) describes an attacker who must already have a local low-privileged logon, must win difficult-to-exploit conditions (AC:H), and must additionally rely on a separate human to perform an action (UI:R) - four friction points stacked together. The 7.5 score is driven almost entirely by the scope change (S:C) plus full C:H/I:H/A:H impact, i.e. a guest/host boundary escape rather than an easily reachable remote hole. Corroborating exploitation signals are weak: EPSS is 0.15% (4th percentile), there is no CISA KEV listing and no public exploit identified, so there is no evidence of active or imminent exploitation. One conflict to flag: the input Tag 'Authentication Bypass' does not match CWE-284 (Improper Access Control) and is not supported by the Oracle description, which describes a privileged local escape, not an auth bypass - treat that tag as unreliable. Net: a legitimately high-impact bug worth patching on normal cycles, but not a drop-everything emergency given local-only access, high complexity, and required user interaction.

An authenticated low-privileged user on a host (or inside a guest VM) running the affected VirtualBox version leverages the access-control weakness in the Core component to break the virtualization boundary. Successful exploitation requires winning difficult timing/state conditions and depends on a separate user performing some interaction (e.g. launching or operating a VM), after which the attacker can compromise the hypervisor and impact the host (scope change). No public exploit code is currently available.