Oracle VM VirtualBox CVE-2026-47054

Exploitation requires a valid low-privileged local logon (PR:L, AV:L) to the Windows host on which Oracle VM VirtualBox is running - this is not remotely reachable and not exploitable from a network or, per the available data, without host credentials. The vulnerability is explicitly limited to Windows hosts only; VirtualBox installations on Linux, macOS, or Solaris hosts are not affected by this CVE. The specific affected build is Oracle VM VirtualBox 7.2.12. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once an attacker has any local account on an affected Windows host, no additional non-default configuration is required to attempt exploitation.

The CVSS 3.1 base score is 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating local access with low attack complexity and low privileges, no user interaction, unchanged scope, and full CIA compromise - consistent with a reliable local privilege-escalation/host-takeover primitive. Offsetting the high impact, the local attack vector (AV:L) means an attacker must already have a foothold on the Windows host, which limits mass or remote exploitation. No EPSS score, KEV listing, POC, or SSVC decision data was provided; therefore exploitation probability cannot be quantified, and the current signal set shows no public exploit identified at time of analysis and no confirmed active exploitation. Net priority: a genuinely dangerous flaw where a foothold exists (escalation to full host takeover), but not an internet-facing emergency - patch on a normal-to-expedited cycle. Note the description explicitly scopes impact to Windows hosts only, so non-Windows deployments are not affected by this CVE.

An attacker with an ordinary (low-privileged) account on a Windows host that runs Oracle VM VirtualBox 7.2.12 invokes a crafted operation against the vulnerable Core component to escalate to full control of VirtualBox on that host, enabling manipulation or theft of any hosted VMs and their data. No user interaction and only low complexity are required per the CVSS vector, though the attacker must first have a valid local logon. No public POC has been identified at time of analysis.