Oracle VM VirtualBox CVE-2026-46815

Exploitation requires local logon to the physical or virtual infrastructure host where Oracle VM VirtualBox 7.2.8 executes, combined with high operating-system privileges (administrator or root equivalent) on that host. The VMSVGA device must be the active virtual graphics adapter for the target VM - this is a non-default configuration in some VirtualBox deployments but is commonly used when 3D acceleration or VMware guest tool compatibility is desired. What limits exploitation: (1) local access is mandatory - no remote vector exists; (2) high privileges are required before any exploit attempt; (3) impact is read-only and limited to a subset of accessible data; (4) the 'Authentication Bypass' tag in EUVD metadata conflicts with PR:H and should not be relied upon as an exploitation condition modifier.

Real-world risk is low despite the scope change. CVSS 3.1 base score is 3.2 (Low), with AV:L requiring local logon, PR:H requiring high privileges, and C:L indicating only partial confidentiality loss - no integrity or availability impact. The scope change (S:C) is notable but does not elevate practical risk substantially given the local-only, high-privilege preconditions. No EPSS data was provided, no CISA KEV listing exists, and no public POC has been identified - all signals pointing to low exploitation pressure. The 'Authentication Bypass' tag in the EUVD intelligence feed directly conflicts with the PR:H CVSS metric; this appears to be a tagging error or metadata artifact, and security teams should not treat this as an authentication bypass vulnerability. The primary audience at risk is multi-tenant VirtualBox environments (e.g., cloud or lab infrastructure) where a privileged operator on one VM could potentially read data from another security domain.

An attacker with administrative privileges already established on the VirtualBox host (e.g., a rogue sysadmin, a compromised privileged account, or an attacker who has escalated privileges through a separate vulnerability) interacts with the VMSVGA device emulation in VirtualBox 7.2.8 to trigger the information disclosure. The read access obtained could expose data accessible within a different security scope, such as memory regions belonging to another guest VM or the host process. No public POC exists to guide this scenario further.