Oracle VM VirtualBox CVE-2025-62588

Exploitation requires the attacker to already have an authenticated, HIGH-privileged local logon (PR:H) on the host operating system where Oracle VM VirtualBox executes - remote and unprivileged exploitation are not possible (AV:L). The affected product must be Oracle VM VirtualBox version 7.1.12 or 7.2.2, Core component. No user interaction is needed (UI:N) and attack complexity is low (AC:L) once the privilege prerequisite is met. The key limiting factor is therefore the high local-privilege requirement: only actors who can already log on with elevated rights to the virtualization host can trigger it, which is why real-world risk is far lower than the 8.2 score suggests; the scope change (S:C) is what elevates impact once triggered.

Signals point to a genuinely serious but access-constrained flaw rather than a mass-exploitation priority. The CVSS 3.1 base score of 8.2 is driven largely by the scope change (S:C) and full Confidentiality/Integrity/Availability impact (C:H/I:H/A:H), meaning a successful attack escapes VirtualBox's boundary to affect the host or other products. However, the vector AV:L/AC:L/PR:H/UI:N shows the attacker must already have local logon AND high privileges on the host where VirtualBox runs - a substantial precondition that sharply narrows the realistic threat population. The EPSS score of 0.21% (10th percentile) corroborates low expected real-world exploitation, and the flaw is NOT in CISA KEV and has no public exploit identified. There is no conflict between signals: high CVSS severity coexists with low exploitation probability precisely because the high-privilege local prerequisite limits opportunistic abuse. CWE-267 (Privilege Defined With Unsafe Actions) is consistent with a privilege-management weakness exploitable by an already-privileged local actor. No SSVC decision data was provided in the input, so automatable/exploitation-maturity cannot be cross-referenced. Bottom line: patch in the normal Oracle CPU cycle; this is not an emergency unless untrusted users hold high-privilege local access to VirtualBox hosts.

A local attacker who already holds high privileges (e.g., an administrative or operator account) on a host running Oracle VM VirtualBox 7.1.12 or 7.2.2 abuses an unsafe privileged action in the Core component to break out of VirtualBox's intended boundary. Because the vulnerability carries a scope change, the resulting takeover of VirtualBox can significantly impact the underlying host or other co-located products. No public exploit code has been identified at the time of analysis, and user interaction is not required.