Oracle VM VirtualBox CVE-2026-46768

Exploitation requires the attacker to hold high-privileged local access (PR:H, AV:L) to the infrastructure running Oracle VM VirtualBox 7.2.8 - specifically, administrative control over a guest VM whose graphics controller is configured as VMSVGA. The VMSVGA adapter must be the active graphics device for that VM (it is a selectable option in VirtualBox VM settings, not universally the default). Exploitation is limited by: (1) the requirement for high OS-level or guest admin privileges, precluding low-privilege or unauthenticated exploitation; (2) VMSVGA must be enabled as the guest's display adapter; and (3) physical or authenticated remote logon access to the hypervisor host or a privileged guest session must already be established. Remote unauthenticated exploitation is not possible given the AV:L and PR:H CVSS metrics. The scope change to additional products amplifies impact but does not lower the access barrier.

The CVSS 3.1 base score of 6.0 accurately reflects a moderate, constrained severity. The local attack vector (AV:L) and high privilege requirement (PR:H) are the dominant risk limiters: an attacker must already possess administrative control over a guest VM running on the target host, ruling out opportunistic remote exploitation entirely. The Scope:Changed attribute is the primary risk amplifier - a single attacker with guest admin access can trigger a host-level DoS affecting all VMs on that hypervisor, which elevates the blast radius significantly in shared or cloud environments. No EPSS score was provided in the available intelligence, so probabilistic exploitation likelihood cannot be quantified. No CISA KEV listing and no public POC exist at time of analysis, indicating no observed widespread exploitation. The practical threat is concentrated in multi-tenant scenarios (cloud providers, VDI farms, shared lab environments) where semi-trusted or potentially malicious guest operators hold VM administrator roles. For single-user desktop deployments, real-world risk is negligible.

A guest VM administrator on a shared VirtualBox 7.2.8 host - such as a tenant in a cloud or VDI environment - sends a sequence of crafted commands or malformed state to the VMSVGA virtual graphics device from within their guest. The fault propagates into the VirtualBox host process, triggering a hang or crash that brings down all VMs running on that hypervisor, denying service to all other tenants. No public proof-of-concept code exists at time of analysis, but Oracle's characterization of the vulnerability as 'easily exploitable' suggests the trigger does not require sophisticated reverse engineering once guest admin access is established.