Oracle VM VirtualBox CVE-2026-46825

Exploitation requires the attacker to hold high-privileged (root or Administrator-equivalent) local access to the infrastructure where Oracle VM VirtualBox executes - either on the host OS or within a guest VM with elevated guest-level privileges. The VMSVGA virtual graphics device must be configured as the active display controller for the target VM; this is a configurable setting in VirtualBox VM settings and is not universally enabled by default. Exploitation is limited to VirtualBox version 7.2.8 only. The local attack vector (AV:L) strictly excludes remote network-based exploitation. No user interaction is required (UI:N) once the attacker has the required access. The principal limiting factor is the PR:H requirement - exploitation is not feasible for unprivileged guest users or remote unauthenticated attackers.

The CVSS 3.1 base score of 6.0 with AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N presents a nuanced risk profile. The local attack vector (AV:L) and high privilege requirement (PR:H) substantially constrain exploitability - only actors with administrative or root-level access to the host or a guest VM can trigger this flaw. EPSS data is not available in the provided intelligence, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not listed in CISA KEV, and no public exploit code has been identified, suggesting no confirmed widespread exploitation. Despite the moderate CVSS score, the scope change (S:C) with high integrity impact (I:H) is a real-world differentiator: attackers operating inside a guest VM with high privilege could affect the host or peer VMs, making this relevant in multi-tenant or shared VirtualBox environments. The 'Authentication Bypass' tag from EUVD is inconsistent with the CVSS PR:H metric - if PR:H is accurate, this is not a true authentication bypass but rather a privilege escalation or isolation break; this discrepancy should be verified against Oracle's advisory. Overall, this is a moderate-priority patch for most deployments, elevated to high priority in shared or cloud-adjacent VirtualBox environments.

An attacker with administrative access inside a VirtualBox guest VM (or directly on the host) issues specially crafted commands to the emulated VMSVGA graphics device, exploiting a flaw in the device emulation layer to write to or corrupt critical VirtualBox data structures. Due to the scope change, the integrity impact could propagate to the host OS or other guest VMs sharing the same VirtualBox instance, enabling data tampering or configuration modification beyond the attacker's initial foothold. No public exploit code has been identified at time of analysis.