Oracle VM VirtualBox CVE-2025-62592

Exploitation requires the attacker to already have HIGH-privileged logon access (PR:H) to the infrastructure/host where Oracle VM VirtualBox executes, and the attack is local only (AV:L) - there is no remote or network exploitation path and no user interaction is needed (UI:N). It applies specifically to Oracle VM VirtualBox versions 7.1.12 and 7.2.2 (Core component). The dominant limiting factor is the high pre-existing privilege requirement, which confines realistic exploitation to already-compromised or insider-controlled hosts; the payoff is a scope change (S:C) exposing confidential data across the VirtualBox boundary into other products/the host.

This is a moderate-severity, low-priority issue despite the CRITICAL perception that 'Oracle VirtualBox vulnerability' can create. The CVSS 3.1 score is 6.0, and every signal points to constrained real-world risk: the vector is AV:L (local only - attacker must already have logon access to the host running VirtualBox), AC:L, and critically PR:H (the attacker must already hold HIGH privileges on the infrastructure). Impact is confidentiality-only (C:H/I:N/A:N) with a scope change (S:C), meaning a compromise of VirtualBox can expose data belonging to other products/the host. The EPSS score is very low at 0.20% (9th percentile), consistent with no public exploit and no mass-exploitation expectation. This is NOT in CISA KEV and there is no POC in the provided data, so there is no evidence of active exploitation. The chief signal to weigh is the high privilege prerequisite (PR:H): an attacker who already has high privileges on the host has limited incremental gain, so the scope change (data exposure across product boundaries) is the only reason this rises above informational. CONFLICT TO NOTE: the input Tags include 'Authentication Bypass', which contradicts the CVSS PR:H requirement (an authentication bypass would imply PR:N) and the CWE-269 (improper privilege management / privilege escalation) classification - the 'Authentication Bypass' label appears inaccurate and should not drive prioritization.

An attacker who already holds high privileges (e.g., administrative/root-level access) on a host machine running an affected VirtualBox build abuses an improper privilege-management flaw in the Core component to read confidential data that crosses the VirtualBox trust boundary into other products or the host (scope change). No public exploit code is identified at time of analysis, and exploitation requires AV:L local access plus existing high privileges, so this is a privilege/boundary-crossing scenario on an already-compromised host rather than a remote break-in.