EUVD-2026-46530
GHSA-v6g4-f4gg-hfqx
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local vector and low privileges match host-logon requirement; pure availability impact with no confidentiality or integrity consequence confirmed by description.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.12. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 5.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
AnalysisAI
Local denial-of-service in Oracle VM VirtualBox 7.2.12 allows a low-privileged attacker with local logon access to the host system to repeatedly crash or hang the VirtualBox process, rendering the hypervisor unavailable. The flaw resides in the Core component and requires no user interaction once the attacker has a local session on the infrastructure host. No public exploit code or active exploitation has been identified at time of analysis, and the impact is limited to availability - confidentiality and integrity are unaffected.
Technical ContextAI
The vulnerability affects Oracle VM VirtualBox version 7.2.12, identified via CPE cpe:2.3:a:oracle_corporation:oracle_vm_virtualbox:*:*:*:*:*:*:*:*. VirtualBox is a Type-2 (hosted) hypervisor; its Core component manages fundamental VM lifecycle operations including CPU emulation, memory management, and device I/O handling. The specific root cause class is not disclosed - CWE is listed as N/A - but the described impact (hang or frequently repeatable crash) is consistent with improper resource handling, an unchecked assertion, or a null dereference triggered from unprivileged guest or host process context. The local attack vector and low privilege requirement suggest the triggering input can be supplied by any authenticated OS user on the host, without requiring hypervisor-level or administrative rights.
RemediationAI
The primary remediation is to apply the patch released as part of Oracle's July 2026 Critical Patch Update, available at https://www.oracle.com/security-alerts/cpujul2026.html. The advisory does not specify an explicit fixed version number beyond the CPU release cycle, so administrators should upgrade to the latest VirtualBox release published alongside or after the July 2026 CPU. As a compensating control where immediate patching is not feasible, restrict local logon access on VirtualBox hosts to trusted accounts only - removing unnecessary local user accounts and applying the principle of least privilege reduces the attacker pool. In shared or multi-tenant environments, consider running VirtualBox on a dedicated host with strict access controls rather than a shared jump server. Note that restricting logon access does not eliminate the vulnerability; it only reduces exposure by shrinking the set of accounts that could trigger it.
More in Oracle Vm Virtualbox
View allLocal privilege escalation and full compromise in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privileged a
Local privilege escalation to full takeover in Oracle VM VirtualBox 7.2.12 on Windows hosts allows a low-privileged atta
Local privilege escalation to full product takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privile
Privileged local compromise of Oracle VM VirtualBox 7.2.8 allows an attacker already authenticated to the host with high
Privilege escalation and host takeover in Oracle VM VirtualBox 7.2.8 via the VMSVGA virtual graphics device allows a hig
Confidentiality and integrity compromise in Oracle VM VirtualBox 7.2.8 (Shared Folders component) allows a low-privilege
Full host takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a high-privileged local attacker who is alread
Privilege-escalating host compromise in Oracle VM VirtualBox 7.2.12 (Core component) lets a high-privileged local attack
Denial-of-service in Oracle VM VirtualBox 7.2.6 (Core component) lets an unauthenticated remote attacker reachable over
Local privilege-driven compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker
Privilege-based host compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker w
Full compromise of Oracle VM VirtualBox 7.2.6 (Core component) is possible for a high-privileged local attacker who can
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today