Oracle VM VirtualBox CVE-2026-46977

Exploitation requires the attacker to have high-privilege local logon access to the physical or virtual host infrastructure where Oracle VM VirtualBox 7.2.8 is running - as defined by the CVSS vector's PR:H and AV:L metrics. The VMSVGA device must be the active graphics adapter for the virtual machine, as this specific component is cited in Oracle's advisory as the affected surface. The vulnerability requires no user interaction (UI:N) and is described as easily exploitable once prerequisites are met (AC:L). Exploitation is bounded by: the requirement for pre-existing high-privilege local host credentials, the specific version constraint of VirtualBox 7.2.8, and the VMSVGA device being active in the VM configuration. Remote attackers without pre-existing local privileged access cannot exploit this vulnerability directly. Impact is confined to unauthorized read access of a limited subset of VirtualBox-accessible data - no write capability or availability disruption is introduced.

The real-world risk of CVE-2026-46977 is low despite the scope-change flag. The CVSS 3.1 base score of 3.2 accurately captures the tight combination of a local attack vector (AV:L), low complexity once access is obtained (AC:L), high privilege prerequisite (PR:H), and a confidentiality-only, low-severity impact (C:L/I:N/A:N). An attacker must already hold high-privilege local credentials on the VirtualBox host - a prerequisite that eliminates remote, unauthenticated, and low-privilege threat actors entirely. The scope change (S:C) is the most risk-significant signal: it means a successful exploit could read data attributable to the host or another VM, not just the guest, elevating concern in multi-tenant or sensitive isolation environments. No EPSS score was provided, so exploitation probability cannot be quantified from this dataset. No KEV listing and no public POC code have been identified, further deprioritizing urgency. The 'Authentication Bypass' intelligence tag conflicts with the advisory's description of a read-access flaw by a high-privileged user - if the tag is accurate, risk could be understated; if erroneous, the current low-risk assessment stands. Organizations operating VirtualBox 7.2.8 in regulated, multi-tenant, or shared-host environments should treat the scope-change as a reason to apply the patch promptly rather than deferring it.

A highly privileged local administrator or compromised high-privilege account on the VirtualBox 7.2.8 host interacts with the VMSVGA device component - for example, through a privileged guest process or direct host-level API call - and triggers the vulnerability to read a restricted subset of VirtualBox-accessible memory or data. Due to the scope change, the exposed data may originate from the host hypervisor layer rather than remaining isolated to the attacking guest's own memory space. No public proof-of-concept code has been identified, and the requirement for pre-existing high-privilege local access makes opportunistic or remote exploitation infeasible without a separate privilege escalation step.