EUVD-2026-46548
GHSA-58c6-f774-rc2c
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local-only attack requiring low-privileged host login with pure availability impact; no confidentiality or integrity effect, and scope unchanged confirms no guest-to-host escalation.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.12. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 5.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
AnalysisAI
Oracle VM VirtualBox 7.2.12 Core component allows a low-privileged local user to repeatedly crash or hang the hypervisor, causing a complete denial of service against all guest virtual machines running on the affected host. This vulnerability is not listed in the CISA KEV catalog and no public exploit code has been identified at time of analysis. The practical blast radius is limited to shared-access VirtualBox hosts where untrusted or semi-trusted local accounts exist, which is more common in developer workstations than hardened production environments.
Technical ContextAI
Oracle VM VirtualBox is a Type-2 hypervisor that executes on top of a host operating system, with the Core component managing guest VM lifecycle, device emulation, and host-kernel driver interactions. The affected CPE is cpe:2.3:a:oracle_corporation:oracle_vm_virtualbox:*:*:*:*:*:*:*:* at version 7.2.12. No CWE has been assigned, which prevents precise root-cause classification; however, the local attack vector combined with a pure availability impact and low complexity suggests the flaw may involve improper input validation, a null pointer dereference, or resource exhaustion within the VirtualBox kernel module or Core component that a local user can trigger through crafted hypercalls, device I/O interactions, or ioctl calls to the VirtualBox driver.
RemediationAI
Oracle released a fix for this vulnerability as part of the July 2026 Critical Patch Update, available at https://www.oracle.com/security-alerts/cpujul2026.html. Organizations should upgrade Oracle VM VirtualBox from version 7.2.12 to the corrected release specified in the CPU; the exact patched version number is not independently confirmed from the available data and must be verified directly from the Oracle advisory. As a compensating control where patching cannot be applied immediately, restrict local login access to VirtualBox hosts strictly to trusted administrative accounts, removing or disabling low-privileged user sessions on those hosts - this directly eliminates the PR:L attacker foothold required by the CVSS vector. Note this control requires host-level access management and does not address the underlying vulnerability. No network-layer mitigations are applicable given the local-only attack vector.
More in Oracle Vm Virtualbox
View allLocal privilege escalation and full compromise in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privileged a
Local privilege escalation to full takeover in Oracle VM VirtualBox 7.2.12 on Windows hosts allows a low-privileged atta
Local privilege escalation to full product takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privile
Privileged local compromise of Oracle VM VirtualBox 7.2.8 allows an attacker already authenticated to the host with high
Privilege escalation and host takeover in Oracle VM VirtualBox 7.2.8 via the VMSVGA virtual graphics device allows a hig
Confidentiality and integrity compromise in Oracle VM VirtualBox 7.2.8 (Shared Folders component) allows a low-privilege
Full host takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a high-privileged local attacker who is alread
Privilege-escalating host compromise in Oracle VM VirtualBox 7.2.12 (Core component) lets a high-privileged local attack
Denial-of-service in Oracle VM VirtualBox 7.2.6 (Core component) lets an unauthenticated remote attacker reachable over
Local privilege-driven compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker
Privilege-based host compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker w
Full compromise of Oracle VM VirtualBox 7.2.6 (Core component) is possible for a high-privileged local attacker who can
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today