Oracle VM VirtualBox CVE-2026-47043

Exploitation requires local interactive or equivalent logon access ('AV:L') to the infrastructure host where Oracle VM VirtualBox 7.2.12 is executing. The attacker must hold high-privilege credentials (PR:H) - such as a local administrator or root-equivalent account on the hypervisor host. No user interaction is required (UI:N) once access is established. The vulnerability is specific to version 7.2.12 of the Core component; no other versions are confirmed affected. The scope change (S:C) suggests the read access may extend to data outside the immediate VirtualBox process, but impact remains limited to a subset of accessible data with no integrity or availability consequence. Exploitation is limited by the requirement for pre-existing high-privileged local access - remote unauthenticated attackers cannot trigger this flaw. The attack is not automatable at scale due to the local access prerequisite.

The compound risk picture is low. CVSS 3.1 base score of 3.2 (Low) is driven by AV:L (local-only exploitation), PR:H (high privileges required), and impact limited to C:L with no integrity or availability impact. The scope change (S:C) is the most notable risk amplifier, as it means a highly privileged actor could read data belonging to adjacent system components - a concern in multi-tenant or shared VirtualBox deployments. No EPSS data was provided, and neither CISA KEV listing nor publicly available exploit code has been identified, making opportunistic or mass exploitation unlikely. The 'Authentication Bypass' tag in the intelligence feed conflicts slightly with PR:H - the vector implies the attacker already holds high privileges, so any authentication bypass appears to be an internal control bypass rather than an external authentication circumvention. Security teams should treat this as a low-urgency patch in environments where VirtualBox hosts sensitive multi-tenant workloads, escalating priority only if high-privileged accounts are untrusted (e.g., shared admin environments).

An administrator or privileged local user with high-privilege logon to a host running VirtualBox 7.2.12 exploits a bypass in the Core component's internal authorization logic to read data that should be restricted - potentially including memory regions or configuration data from other VMs or the host environment due to the scope change. No public exploit code has been identified at time of analysis, meaning exploitation currently requires manual discovery of the flaw internals.