EUVD-2026-46529
GHSA-jfmh-6vwj-5w6c
Severity by source
AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
Local-only vector with high privileges required and no integrity or availability impact; scope change acknowledged but confined to limited confidentiality disclosure.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 3.2 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N).
AnalysisAI
Local privilege abuse in Oracle VM VirtualBox 7.2.12 Core component permits a high-privileged local attacker to read a subset of VirtualBox-accessible data, with confirmed scope change indicating potential exposure of data belonging to co-hosted or adjacent products. The CVSS score of 3.2 (Low) reflects the constrained attack surface - requiring local logon with high privileges - but the scope change flag (S:C) elevates the architectural concern, as information disclosed may originate outside the directly compromised VirtualBox instance. No public exploit code or active exploitation has been identified at time of analysis.
Technical ContextAI
Oracle VM VirtualBox is a cross-platform Type-2 (hosted) hypervisor. The vulnerability resides in the Core component, which manages the central virtualization runtime, VM state, and inter-component communication. The CPE cpe:2.3:a:oracle_corporation:oracle_vm_virtualbox:*:*:*:*:*:*:*:* confirms this is an application-layer flaw. The CVSS scope-change indicator (S:C) suggests the confidentiality breach extends beyond the VirtualBox process boundary - potentially exposing host OS data or data from other VMs managed by the same hypervisor instance. CWE is not assigned, limiting root-cause class identification, though the 'Authentication Bypass' tag from intelligence sources implies an internal authorization check may be bypassed within the Core component even by an already-privileged actor. The lack of CWE is a gap in the official record.
RemediationAI
Consult the Oracle Critical Patch Update (CPU) for July 2026 at https://www.oracle.com/security-alerts/cpujul2026.html for the official patch. Oracle CPUs typically specify a fixed version in their risk matrix - users running VirtualBox 7.2.12 should upgrade to any version identified as fixed in that advisory. Because the exploit requires local logon with high privileges, a compensating control where an immediate patch is not feasible is to restrict who holds high-privileged local accounts on hypervisor hosts - specifically, ensuring only trusted administrators have direct logon access to infrastructure running VirtualBox. Reducing the privileged user surface limits the attacker population without requiring service downtime, though this does not eliminate the vulnerability. Review host-level audit logging on VirtualBox Core activity to detect anomalous data reads if patching is delayed.
More in Oracle Vm Virtualbox
View allLocal privilege escalation and full compromise in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privileged a
Local privilege escalation to full takeover in Oracle VM VirtualBox 7.2.12 on Windows hosts allows a low-privileged atta
Local privilege escalation to full product takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privile
Privileged local compromise of Oracle VM VirtualBox 7.2.8 allows an attacker already authenticated to the host with high
Privilege escalation and host takeover in Oracle VM VirtualBox 7.2.8 via the VMSVGA virtual graphics device allows a hig
Confidentiality and integrity compromise in Oracle VM VirtualBox 7.2.8 (Shared Folders component) allows a low-privilege
Full host takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a high-privileged local attacker who is alread
Privilege-escalating host compromise in Oracle VM VirtualBox 7.2.12 (Core component) lets a high-privileged local attack
Denial-of-service in Oracle VM VirtualBox 7.2.6 (Core component) lets an unauthenticated remote attacker reachable over
Local privilege-driven compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker
Privilege-based host compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker w
Full compromise of Oracle VM VirtualBox 7.2.6 (Core component) is possible for a high-privileged local attacker who can
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today