What is the CVSS score of CVE-2026-46816?

CVE-2026-46816 has a CVSS 3.1 base score of 3.2 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Oracle VM VirtualBox CVE-2026-46816

EUVD-2026-37333 LOW

Information Exposure (CWE-200)

2026-06-16 oracle

Oracle Oracle Vm Virtualbox Information Disclosure

3.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

3.2 LOW

AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

vuln.today AI

3.2 LOW

Local access and high guest/host privileges required to reach VMSVGA device; scope change reflects guest-to-host boundary crossing; confidentiality-only, no write or availability impact.

3.1 AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 00:25 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA device). The supported version that is affected is 7.2.8. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 3.2 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N).

AnalysisAI

Local information disclosure in Oracle VM VirtualBox 7.2.8 via the VMSVGA virtual graphics device allows a high-privileged guest or host attacker to read a subset of VirtualBox-accessible data across the VM isolation boundary. The scope change (S:C) in the CVSS vector indicates the vulnerability crosses the hypervisor boundary, making it relevant to multi-tenant or shared virtualization deployments despite the low base score of 3.2. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Gain high-privileged access in VirtualBox 7.2.8 guest

Delivery

Confirm guest uses VMSVGA graphics controller

Exploit

Craft malicious VMSVGA device interactions

Execution

Trigger boundary enforcement failure in host emulator

Impact

Read subset of hypervisor-accessible data across VM boundary

Access

Gain high-privileged access in VirtualBox 7.2.8 guest

Delivery

Confirm guest uses VMSVGA graphics controller

Exploit

Craft malicious VMSVGA device interactions

Execution

Trigger boundary enforcement failure in host emulator

Impact

Read subset of hypervisor-accessible data across VM boundary

Vulnerability AssessmentAI

Exploitation	Exploitation requires local logon access to the system where Oracle VM VirtualBox 7.2.8 is running, with high privileges (root on Linux/macOS or Administrator on Windows) within the guest VM or on the host - confirmed by CVSS PR:H. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score of 3.2 (Low) reflects meaningful constraints: local attack vector (AV:L), high privileges required (PR:H), and impact limited to partial confidentiality (C:L) with no integrity or availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A root-level user inside a VirtualBox 7.2.8 guest VM configured with the VMSVGA graphics controller crafts malformed or unexpected interactions with the emulated VMSVGA device registers or command buffer, triggering a boundary enforcement failure in VirtualBox's device emulation layer on the host. The VirtualBox hypervisor process then exposes a subset of its accessible memory or internal data to the guest, allowing the attacker to read information that should not cross the VM isolation boundary. …
Remediation	The primary remediation is to apply Oracle's June 2026 Critical Patch Update, documented at https://www.oracle.com/security-alerts/cspujun2026.html. … Detailed patch versions, workarounds, and compensating controls in full report.