EUVD-2026-46539
GHSA-qqhx-m6vg-fc8g
Severity by source
AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L
Local-only attack with mandatory third-party interaction; low privilege sufficient; high integrity impact on VM data; no confidentiality loss; partial availability impact aligns with partial DOS.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.12. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 5.6 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L).
AnalysisAI
Local exploitation of the Core component in Oracle VM VirtualBox 7.2.12 allows a low-privileged attacker to perform unauthorized creation, deletion, or modification of critical VirtualBox data and cause a partial denial of service - provided a second user's interaction can be induced. Oracle disclosed this in the July 2026 Critical Patch Update (CPU), classifying it as easily exploitable under those local conditions. No public exploit code or active exploitation has been identified at time of analysis, and the mandatory human-interaction requirement (UI:R) materially constrains unassisted or automated attacks.
Technical ContextAI
Oracle VM VirtualBox is a cross-platform Type-2 hypervisor application that runs on commodity host operating systems (Windows, Linux, macOS) to provide hardware-assisted virtualization for guest VMs. The affected component - Core - encompasses the central virtualization engine responsible for managing virtual machine state, disk images, device emulation, and guest-to-host interface logic. The CPE cpe:2.3:a:oracle_corporation:oracle_vm_virtualbox:*:*:*:*:*:*:*:* broadly covers the application; Oracle's advisory pins the vulnerability to version 7.2.12 specifically. CWE is listed as N/A, meaning Oracle has not publicly disclosed the root cause class - whether a race condition, improper access control, or another weakness type is unknown from available data. The local attack vector (AV:L) confirms the flaw is exercised from within the host environment, not over a network interface, consistent with a Core-layer guest-host interaction or file/device handling path.
RemediationAI
Apply Oracle's July 2026 Critical Patch Update, which addresses this vulnerability in Oracle VM VirtualBox 7.2.12; the advisory is at https://www.oracle.com/security-alerts/cpujul2026.html. The exact patched release version number is not independently confirmed from the available intelligence - Oracle's CPU guidance should be followed to identify the specific build. As a compensating control pending patching, restrict local interactive logon access to VirtualBox host systems to only explicitly vetted accounts, directly countering the PR:L and AV:L prerequisites. Additionally, review and limit which users can interact with VirtualBox GUI or CLI sessions on shared hosts, as the UI:R requirement means reducing the pool of users who could unknowingly provide the necessary interaction. On multi-user hosts, consider applying OS-level mandatory access controls (e.g., AppArmor or SELinux profiles for VirtualBox processes) to limit the blast radius of unauthorized data modification to VirtualBox-owned paths only.
More in Oracle Vm Virtualbox
View allLocal privilege escalation and full compromise in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privileged a
Local privilege escalation to full takeover in Oracle VM VirtualBox 7.2.12 on Windows hosts allows a low-privileged atta
Local privilege escalation to full product takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privile
Privileged local compromise of Oracle VM VirtualBox 7.2.8 allows an attacker already authenticated to the host with high
Privilege escalation and host takeover in Oracle VM VirtualBox 7.2.8 via the VMSVGA virtual graphics device allows a hig
Confidentiality and integrity compromise in Oracle VM VirtualBox 7.2.8 (Shared Folders component) allows a low-privilege
Full host takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a high-privileged local attacker who is alread
Privilege-escalating host compromise in Oracle VM VirtualBox 7.2.12 (Core component) lets a high-privileged local attack
Denial-of-service in Oracle VM VirtualBox 7.2.6 (Core component) lets an unauthenticated remote attacker reachable over
Local privilege-driven compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker
Privilege-based host compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker w
Full compromise of Oracle VM VirtualBox 7.2.6 (Core component) is possible for a high-privileged local attacker who can
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today