EUVD-2026-37333Severity by source
AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
Local access and high guest/host privileges required to reach VMSVGA device; scope change reflects guest-to-host boundary crossing; confidentiality-only, no write or availability impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA device). The supported version that is affected is 7.2.8. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 3.2 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N).
AnalysisAI
Local information disclosure in Oracle VM VirtualBox 7.2.8 via the VMSVGA virtual graphics device allows a high-privileged guest or host attacker to read a subset of VirtualBox-accessible data across the VM isolation boundary. The scope change (S:C) in the CVSS vector indicates the vulnerability crosses the hypervisor boundary, making it relevant to multi-tenant or shared virtualization deployments despite the low base score of 3.2. No public exploit has been identified and this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog; Oracle addressed it in the June 2026 Critical Patch Update.
Technical ContextAI
The VMSVGA (VMware SVGA II) device is a virtual graphics adapter emulated by VirtualBox to provide guest VMs with accelerated 2D/3D rendering. Oracle VM VirtualBox emulates this hardware interface in software, and flaws in device emulation code can allow guest OS interactions to influence the hypervisor process in unintended ways. The CVSS scope change (S:C) is the critical signal here: it indicates the vulnerability crosses the VM isolation boundary - a guest-side attacker can cause an impact on the host hypervisor scope or adjacent VMs, which is the core security concern of virtual machine escape-class research. The CPE entry (cpe:2.3:a:oracle_corporation:oracle_vm_virtualbox:7.2.8) confirms the specific affected release as 7.2.8. No CWE has been assigned by Oracle, so the precise root cause class - whether an out-of-bounds read, improper memory isolation, or device register validation failure - cannot be confirmed from available data. The ENISA EUVD entry (EUVD-2026-37333) tags this as 'Authentication Bypass', which is potentially inconsistent with the PR:H CVSS rating and warrants vendor clarification.
RemediationAI
The primary remediation is to apply Oracle's June 2026 Critical Patch Update, documented at https://www.oracle.com/security-alerts/cspujun2026.html. The advisory does not state an explicit patched release version in the data available for this analysis - consult the Oracle CPU directly to identify the target upgrade version for VirtualBox 7.2.8. As a compensating control where immediate patching is not feasible, reconfigure affected guest VMs to use an alternative graphics controller (VBoxSVGA or VBoxVGA instead of VMSVGA) via VirtualBox VM settings; this disables the vulnerable device component but may reduce or eliminate 3D graphics acceleration in the guest, impacting workloads that rely on it. Additionally, restrict high-privileged (root/Administrator) guest account access to the minimum necessary user set, as exploitation requires PR:H - narrowing who can operate at that privilege level within the guest directly reduces the attacker population. In multi-tenant environments, prioritize patching VMs running sensitive or cross-trust workloads first given the scope-change boundary-crossing nature of the flaw.
More in Oracle Vm Virtualbox
View allLocal privilege escalation and full compromise in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privileged a
Local privilege escalation to full takeover in Oracle VM VirtualBox 7.2.12 on Windows hosts allows a low-privileged atta
Local privilege escalation to full product takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privile
Privileged local compromise of Oracle VM VirtualBox 7.2.8 allows an attacker already authenticated to the host with high
Privilege escalation and host takeover in Oracle VM VirtualBox 7.2.8 via the VMSVGA virtual graphics device allows a hig
Confidentiality and integrity compromise in Oracle VM VirtualBox 7.2.8 (Shared Folders component) allows a low-privilege
Full host takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a high-privileged local attacker who is alread
Privilege-escalating host compromise in Oracle VM VirtualBox 7.2.12 (Core component) lets a high-privileged local attack
Denial-of-service in Oracle VM VirtualBox 7.2.6 (Core component) lets an unauthenticated remote attacker reachable over
Local privilege-driven compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker
Privilege-based host compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker w
Full compromise of Oracle VM VirtualBox 7.2.6 (Core component) is possible for a high-privileged local attacker who can
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today