EUVD-2026-37366Severity by source
AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Local logon and high privileges (typically guest-root) needed, exploitation is non-trivial (AC:H), and successful VM escape crosses scope with full host CIA impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA device). The supported version that is affected is 7.2.8. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).
AnalysisAI
Privilege escalation and host takeover in Oracle VM VirtualBox 7.2.8 via the VMSVGA virtual graphics device allows a high-privileged local attacker to break out of the virtualization boundary and impact additional products beyond VirtualBox itself (scope change). The flaw carries a CVSS 3.1 base score of 7.5 with full confidentiality, integrity, and availability impact, but exploitation is rated high complexity. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Technical ContextAI
The vulnerability resides in the VMSVGA paravirtualized graphics device, an emulated VMware-compatible SVGA II adapter that VirtualBox exposes to guest virtual machines for accelerated 2D/3D rendering. VMSVGA implementations have historically been a rich source of guest-to-host escape bugs because they expose a complex FIFO command queue, surface/shader/3D resource handling, and DMA-style memory mappings between the guest and the host hypervisor process. No CWE was assigned by NVD, but Oracle's description of a scope-changed host compromise originating from a guest-context operation is consistent with the VM-escape class of memory-corruption or logic flaws typical for this device. The affected build is the Oracle-supported 7.2.8 release, identified by CPE cpe:2.3:a:oracle_corporation:oracle_vm_virtualbox:*.
RemediationAI
Patch available per vendor advisory - apply the fixes shipped in the Oracle Critical Patch Update of June 2026 documented at https://www.oracle.com/security-alerts/cspujun2026.html, which supersedes Oracle VM VirtualBox 7.2.8; consult the CPU matrix for the exact post-7.2.8 fixed build before deploying. Until patching is complete, the most effective compensating control is to switch guest virtual machines from the VMSVGA graphics controller to the legacy VBoxVGA or VBoxSVGA adapter in each VM's Display settings, which removes the vulnerable code path at the cost of losing 3D acceleration and some modern guest display features. Additionally, restrict who can log on to VirtualBox hosts and hold local administrative privileges, treat guest-root as a stepping stone rather than a contained tier, and avoid running untrusted guests on shared hosts until the CPU patch is applied.
More in Oracle Vm Virtualbox
View allLocal privilege escalation and full compromise in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privileged a
Local privilege escalation to full takeover in Oracle VM VirtualBox 7.2.12 on Windows hosts allows a low-privileged atta
Local privilege escalation to full product takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privile
Privileged local compromise of Oracle VM VirtualBox 7.2.8 allows an attacker already authenticated to the host with high
Confidentiality and integrity compromise in Oracle VM VirtualBox 7.2.8 (Shared Folders component) allows a low-privilege
Full host takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a high-privileged local attacker who is alread
Privilege-escalating host compromise in Oracle VM VirtualBox 7.2.12 (Core component) lets a high-privileged local attack
Denial-of-service in Oracle VM VirtualBox 7.2.6 (Core component) lets an unauthenticated remote attacker reachable over
Local privilege-driven compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker
Privilege-based host compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker w
Full compromise of Oracle VM VirtualBox 7.2.6 (Core component) is possible for a high-privileged local attacker who can
Guest-to-host compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker to take
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today