EUVD-2026-46528
GHSA-mc2w-53wr-hj5x
Severity by source
AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
Local attack requiring high OS privileges to reach VirtualBox Core; only availability impacted, but scope change propagates crash to adjacent host-resident systems.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 6.0 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H).
AnalysisAI
Oracle VM VirtualBox 7.2.12 Core component allows a high-privileged local attacker to cause a complete denial-of-service by crashing or hanging the hypervisor, with a scope change indicating the impact can extend beyond the primary VirtualBox process to affect additional products on the same infrastructure. The vulnerability is confirmed by Oracle's July 2026 Critical Patch Update. No public exploit code or active exploitation has been identified at time of analysis.
Technical ContextAI
The vulnerability resides in the Core component of Oracle VM VirtualBox 7.2.12, the foundational subsystem responsible for virtual machine execution and hardware abstraction (CPE: cpe:2.3:a:oracle_corporation:oracle_vm_virtualbox:*:*:*:*:*:*:*:*). The CVSS vector (AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H) indicates a local attack path requiring high privileges but with a changed scope, meaning a successful denial-of-service in the Core component can propagate beyond the VirtualBox process itself - likely affecting the host OS, other running VMs, or dependent infrastructure services sharing the same host. CWE classification was not assigned by the reporter, so the precise root cause class (e.g., null pointer dereference, resource exhaustion, race condition) is not confirmed from available data. The Oracle advisory is part of the July 2026 CPU batch disclosure.
RemediationAI
Consult Oracle's July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html to identify the patched release. A specific fixed version number is not independently confirmed in the available intelligence data, so the advisory should be treated as the authoritative source for upgrade targeting. As a compensating control where patching is not immediately possible, restrict local logon access to host systems running VirtualBox 7.2.12 to only trusted, operationally necessary accounts - reducing the pool of principals who meet the PR:H prerequisite. In multi-tenant environments, consider migrating workloads off affected hosts or suspending non-essential VirtualBox instances until patching is complete. Note that restricting logon access does not eliminate the vulnerability but raises the bar for exploitation by removing the high-privilege local access prerequisite.
More in Oracle Vm Virtualbox
View allLocal privilege escalation and full compromise in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privileged a
Local privilege escalation to full takeover in Oracle VM VirtualBox 7.2.12 on Windows hosts allows a low-privileged atta
Local privilege escalation to full product takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privile
Privileged local compromise of Oracle VM VirtualBox 7.2.8 allows an attacker already authenticated to the host with high
Privilege escalation and host takeover in Oracle VM VirtualBox 7.2.8 via the VMSVGA virtual graphics device allows a hig
Confidentiality and integrity compromise in Oracle VM VirtualBox 7.2.8 (Shared Folders component) allows a low-privilege
Full host takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a high-privileged local attacker who is alread
Privilege-escalating host compromise in Oracle VM VirtualBox 7.2.12 (Core component) lets a high-privileged local attack
Denial-of-service in Oracle VM VirtualBox 7.2.6 (Core component) lets an unauthenticated remote attacker reachable over
Local privilege-driven compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker
Privilege-based host compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker w
Full compromise of Oracle VM VirtualBox 7.2.6 (Core component) is possible for a high-privileged local attacker who can
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today