Oracle VM VirtualBox CVE-2025-62641

Exploitation requires the attacker to already hold a high-privilege local logon (PR:H) on the infrastructure where Oracle VM VirtualBox executes - i.e. privileged access to the host, or, given the scope change indicating a guest-to-host escape, privileged control within a guest VM. There is no network vector (AV:L) and no user interaction (UI:N). Practical limiting factors: the attacker must first obtain privileged access, only VirtualBox 7.1.12 and 7.2.2 are named, and applying the Oracle October 2025 CPU removes the flaw. The value of the exploit is boundary-crossing (S:C) - turning existing privileged access on one component into compromise of the host and additional products.

This is a genuine but access-gated risk rather than a mass-exploitation emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, base 8.2) is HIGH primarily because of the scope change (S:C) and full C/I/A impact, not because of easy reach - attack is local (AV:L) and requires high privilege (PR:H), i.e. an attacker who already holds a privileged logon on the host where VirtualBox runs (or, given VM-escape semantics, privileged control within a guest). EPSS is low at 0.21% (9th percentile), consistent with a local, privilege-gated flaw that is not attractive for opportunistic scanning. There is no CISA KEV listing and no public exploit identified at time of analysis, so exploitation status is 'no public exploit identified.' The signals are internally consistent: high technical impact but constrained prerequisites. Note CWE-267 (Privilege Defined With Unsafe Actions) points to a privilege/isolation-boundary weakness, which aligns with the S:C escape narrative - the input 'Information Disclosure' tag understates this (it is a full-CIA host/hypervisor takeover, not mere disclosure).

An attacker who already has a privileged foothold - for example administrative control inside a VirtualBox guest or a privileged local account on the host - abuses an unsafe privileged action in the VirtualBox Core to cross the virtualization boundary. Because of the scope change, the attack impacts components beyond VirtualBox itself, resulting in compromise of the host or other products and full takeover of the virtualization stack. No public proof-of-concept exists at time of analysis.