Oracle VM VirtualBox CVE-2025-62589

Exploitation requires the attacker to already have high-privileged local logon access to the host infrastructure where Oracle VM VirtualBox executes (CVSS PR:H, AV:L) - there is no network-facing or unauthenticated path. The affected deployments are specifically Oracle VM VirtualBox 7.1.12 and 7.2.2. The attack targets the Core component and produces a scope change, meaning a successful breakout can affect products beyond VirtualBox on the same host; this makes multi-tenant, shared, or untrusted-code lab hosts the highest-risk deployments. Limiting factors: the required high privilege level and local access sharply reduce the realistic attacker population to insiders or an adversary who has already gained a privileged foothold, and no user interaction is involved once that access exists (UI:N).

Signals are consistent and point to a serious-but-not-emergency issue. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, base 8.2) describes a locally-exploitable flaw requiring high privileges but with a scope change and full confidentiality/integrity/availability impact - the classic profile of a guest-to-host / hypervisor-boundary escape where an already-privileged local actor breaks out to compromise additional products beyond VirtualBox itself. Counterbalancing the high score, the EPSS probability is only 0.21% (10th percentile), it is NOT on the CISA KEV list, and no public PoC is referenced, so this is a high-CVSS issue driven by impact and scope change rather than by ease or likelihood of real-world exploitation. The PR:H requirement is the key mitigating factor: an attacker must already possess high privileges and local logon on the host, which substantially narrows the realistic threat to insiders, post-compromise lateral movement, or untrusted-code/multi-tenant lab scenarios. No conflicting data was detected - the description's 'high privileged attacker with logon to the infrastructure' aligns cleanly with AV:L and PR:H. CWE-267 (privilege management / unsafe privileged action) is consistent with a boundary-escape class. Treat as a patch-in-normal-cycle priority for exposed/multi-tenant VirtualBox hosts, not a drop-everything emergency.

A local attacker who already holds high privileges on a host running Oracle VM VirtualBox 7.1.12 or 7.2.2 abuses the Core component to break the virtualization boundary and take over the VirtualBox instance, with a scope change that lets the attack impact additional products on the host. No public exploit code is identified, so this remains a theoretical/post-compromise scenario rather than an off-the-shelf attack. The AV:L/AC:L profile means the exploit itself is low-complexity once the attacker has the required local privileged foothold.