EUVD-2026-37457Severity by source
AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
Local access and high guest/host privileges required; scope change reflects host-process-level DoS; no confidentiality or integrity impact present.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA device). The supported version that is affected is 7.2.8. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 6.0 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H).
AnalysisAI
Denial-of-service in Oracle VM VirtualBox 7.2.8 affects the VMSVGA virtual graphics device emulation layer, allowing a highly privileged local attacker to cause a persistent hang or fully repeatable crash of the hypervisor process. The CVSS Scope:Changed metric signals that the DoS impact propagates beyond the attacker's own guest VM, potentially destabilizing the host process and all co-resident VMs - a meaningful concern in multi-tenant and VDI environments. No public exploit code exists and no CISA KEV listing is present at time of analysis; exploitation is bounded by the requirement for high-privileged local access to the infrastructure.
Technical ContextAI
The vulnerability is located in the VMSVGA device emulation component of Oracle VM VirtualBox 7.2.8 (CPE: cpe:2.3:a:oracle_corporation:oracle_vm_virtualbox:*:*:*:*:*:*:*:*). VMSVGA emulates the VMware SVGA II virtual graphics adapter, a selectable display controller in VirtualBox guest configurations that provides 2D/3D display acceleration for guests. As a type-2 hypervisor, VirtualBox runs device emulation within its host process; a fault in the VMSVGA code path can therefore crash or hang the entire VirtualBox host process rather than being isolated to a single guest. No CWE is assigned in the available data, preventing definitive root-cause classification. Based on the DoS-only impact and device emulation context, the flaw is consistent with improper input validation or uncontrolled resource consumption within the VMSVGA emulator, but this is inferred rather than confirmed. The CVSS S:C (Scope Changed) metric confirms that the impact crosses the VM isolation boundary to affect the broader virtualization infrastructure.
RemediationAI
The primary remediation is to apply Oracle's patch as detailed in the June 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cspujun2026.html. The exact fixed version number is not explicitly stated in the available data beyond confirming 7.2.8 as vulnerable; administrators should consult the Oracle advisory directly to identify the specific patched release and apply it immediately. As a compensating control where patching is not immediately feasible, administrators can switch the affected guest VM's graphics controller from VMSVGA to an alternative adapter such as VBoxSVGA or VBoxVGA via the VirtualBox VM settings; this eliminates the vulnerable device from the attack surface at the cost of losing VMware SVGA II guest display acceleration features and potentially requiring guest driver changes. Additionally, restricting guest VM administrative credentials to trusted personnel reduces the pool of potential attackers given the PR:H requirement. No workarounds are confirmed by Oracle in the available references.
More in Oracle Vm Virtualbox
View allLocal privilege escalation and full compromise in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privileged a
Local privilege escalation to full takeover in Oracle VM VirtualBox 7.2.12 on Windows hosts allows a low-privileged atta
Local privilege escalation to full product takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privile
Privileged local compromise of Oracle VM VirtualBox 7.2.8 allows an attacker already authenticated to the host with high
Privilege escalation and host takeover in Oracle VM VirtualBox 7.2.8 via the VMSVGA virtual graphics device allows a hig
Confidentiality and integrity compromise in Oracle VM VirtualBox 7.2.8 (Shared Folders component) allows a low-privilege
Full host takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a high-privileged local attacker who is alread
Privilege-escalating host compromise in Oracle VM VirtualBox 7.2.12 (Core component) lets a high-privileged local attack
Denial-of-service in Oracle VM VirtualBox 7.2.6 (Core component) lets an unauthenticated remote attacker reachable over
Local privilege-driven compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker
Privilege-based host compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker w
Full compromise of Oracle VM VirtualBox 7.2.6 (Core component) is possible for a high-privileged local attacker who can
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today