Oracle VM VirtualBox CVE-2025-62591

Exploitation requires an attacker who already holds high privileges (PR:H) and an interactive logon to the host operating system on which Oracle VM VirtualBox runs - there is no network or remote path (AV:L) and no user interaction is needed (UI:N). This confines realistic exploitation to malicious or compromised privileged local accounts (e.g., a host administrator or an attacker who has already escalated on the host). The description cites no special feature, protocol, or non-default configuration toggle; the primary limiting factor is the high-privilege host-logon prerequisite, which substantially narrows the viable attacker population. Affected deployments are VirtualBox 7.1.12 and 7.2.2.

This is a genuinely medium-risk issue rather than a top priority. The CVSS 3.1 base score is 6.0 with vector AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N, meaning exploitation requires local access (AV:L) and, critically, high existing privileges (PR:H) on the host where Oracle VM VirtualBox runs - this is not a remote or unauthenticated flaw. The impact is confidentiality-only (C:H, I:N, A:N) but carries a scope change (S:C), so a successful attack can reach data belonging to additional products beyond VirtualBox itself, which is what elevates the score despite the high privilege prerequisite. The EPSS score of 0.20% (9th percentile) is very low, there is no CISA KEV listing, and no public exploit was provided, so no public exploit identified at time of analysis. All signals are consistent and point the same direction: high attacker prerequisites plus low exploitation probability make this a patch-in-normal-cycle item, not an emergency. Note one inconsistency to verify: the input Tag 'Authentication Bypass' conflicts with both CWE-267 (Privilege Defined With Unsafe Actions) and the PR:H vector, which describe privilege abuse by an already-authenticated high-privileged user rather than a bypass of authentication.

A high-privileged user already logged on to the host operating system where Oracle VM VirtualBox executes abuses a flaw in the Core component to gain unauthorized read access to critical data. Because of the scope change, the disclosure can extend to data belonging to products outside VirtualBox on the same host. No public exploit code is available, so exploitation would require custom tooling by an insider or an attacker who has already gained privileged host access.