Oracle VM VirtualBox CVE-2026-46874

Exploitation requires two confirmed prerequisites derived directly from the CVSS vector and Oracle's description: (1) local logon access to the operating system host where Oracle VM VirtualBox 7.2.8 is installed (AV:L - no remote network path exists), and (2) a high-privileged account on that host (PR:H - standard unprivileged or low-privileged users cannot exploit this). The vulnerability is confined to the Core component of VirtualBox 7.2.8 specifically. Limiting factors include: no network-based exploitation vector; exploitation is impossible without pre-existing administrative or equivalent local privileges; no user interaction by a victim is required once the attacker has the necessary access. The scope change (S:C) means a successful exploit may allow reading data from guest VMs or adjacent system resources, but the data exposure is limited to a subset (C:L), not full confidentiality compromise. The 'Authentication Bypass' tag is inconsistent with PR:H and should not be interpreted as enabling unauthenticated access - this discrepancy is flagged as unresolved.

The CVSS 3.1 base score of 3.2 (Low) accurately reflects the highly constrained exploitation surface: the attacker must already hold high-privileged local access (AV:L/PR:H), which limits the realistic attacker population to compromised administrator accounts or malicious insiders on the VirtualBox host. The 'Easily exploitable' descriptor from the Oracle advisory slightly elevates concern - low attack complexity (AC:L) means no special conditions or race conditions are required once prerequisites are met. The scope change (S:C) is the primary architectural concern: it indicates the vulnerability crosses a trust boundary (host-to-guest or VirtualBox-to-OS) and can expose data not directly owned by the attacking process. However, confidentiality impact is capped at Low (C:L, a subset of data), and there is zero integrity or availability impact. No EPSS score was provided in available intelligence, making probabilistic exploitation forecasting impossible. No KEV listing and no known public POC confirm this is not under active or widespread exploitation. The 'Authentication Bypass' tag introduces a minor data conflict with PR:H - if the flaw truly bypasses authentication, PR:N would be more appropriate; this discrepancy should be verified against Oracle's detailed advisory, as tag metadata from aggregators is not always authoritative.

An attacker who has compromised a high-privileged administrator account on the VirtualBox 7.2.8 host - either through credential theft or lateral movement - invokes a flaw in the Core component to read a subset of VirtualBox-accessible memory or configuration data that extends across the guest boundary, potentially accessing data belonging to co-resident guest VMs. Because the attack requires existing high-privilege local access (not a remote unauthenticated path), this scenario is most relevant in shared infrastructure or cloud-adjacent environments where multiple tenants or workloads run under the same VirtualBox host. No public POC exists at time of analysis.