Oracle VM VirtualBox CVE-2025-62590

Requires the attacker to already possess HIGH privileges with an interactive logon to the infrastructure where Oracle VM VirtualBox executes (PR:H, AV:L) - e.g., administrative/root access within a guest VM or on the host running VirtualBox 7.1.12 or 7.2.2. No user interaction is needed (UI:N) and attack complexity is low (AC:L), but the flaw is NOT remotely reachable and NOT exploitable by an unprivileged user; the scope change (S:C) indicates the impact crosses the virtualization boundary to affect the host/other products. Limiting factors: local access only, pre-existing high privilege, and affected-version specificity (only 7.1.12 and 7.2.2 are listed as affected).

Multiple signals converge on this being a genuine but NOT top-priority issue. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, base 8.2) describes a locally-exploitable flaw requiring HIGH privileges already present on the system, but with a scope change and full confidentiality/integrity/availability impact - consistent with a guest-to-host (VM escape) takeover where an already-privileged attacker inside the virtualization boundary compromises the host. The EPSS score is very low (0.21%, 10th percentile), there is NO CISA KEV listing, and NO public exploit was identified in the provided data - three independent signals all pointing to low near-term exploitation likelihood. The PR:H requirement is the key risk dampener: an attacker must already hold high privileges (e.g., root/admin within a guest or on the infrastructure), so this is a privilege-boundary/escape bug rather than an initial-access vector. The high base score is driven almost entirely by the scope change and full CIA impact, not by ease of reaching the vulnerable code. Net: real and worth patching in virtualization/multi-tenant environments, but the low EPSS, absent KEV, absent POC, and PR:H prerequisite make it a managed-priority patch, not an emergency. No signals are directly conflicting; the elevated CVSS is explained by impact/scope rather than by accessibility, which is consistent with the low exploitation-probability signals.

An attacker who already holds high privileges inside a VirtualBox guest (or on the host infrastructure running VirtualBox 7.1.12 or 7.2.2) abuses the Core component to break the virtualization boundary and take over the hypervisor host, impacting other guests and the host itself (scope change). No user interaction is required and attack complexity is low, but local high-privileged access is a prerequisite. No public exploit code was identified at time of analysis, and exploitation requires local presence rather than remote network access.