Oracle VM VirtualBox CVE-2026-47062

Exploitation requires an active local login session on the host machine running Oracle VM VirtualBox 7.2.12 - remote network access alone is insufficient (AV:L). The attacker needs at minimum a low-privileged OS account on the host (PR:L); standard unprivileged user accounts qualify. No interaction from any other user is required (UI:N). No specific non-default configuration, guest OS type, or enabled feature is mentioned as a prerequisite in the advisory description. Exploitation is limited to denial of service only - no confidentiality or integrity compromise is achievable through this vector (C:N/I:N). Deployments where VirtualBox hosts are accessible only to system administrators are not realistically at risk; shared-access hosts (developer machines, lab environments) face the highest exposure.

The vendor-supplied CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) scores 5.5 Medium, which accurately reflects the constrained threat model: exploitation requires an existing authenticated local session with at least low privileges, and the scope is unchanged meaning guest-to-host or cross-VM escalation is not demonstrated. There is no CISA KEV listing, no identified public exploit code, and no EPSS score was provided in the input data. The absence of a CWE classification is a gap - it prevents defenders from assessing whether the root cause class has broader implications. Confidentiality and integrity are entirely unaffected, making this a pure DoS primitive. Real-world priority is low for environments where VirtualBox hosts are administrator-only; it rises to medium in shared developer environments, university labs, or any deployment where low-privileged users have local host access.

A developer or low-privileged user with an existing local session on a shared VirtualBox 7.2.12 host crafts a malformed input - such as a specific ioctl call sequence to the VirtualBox kernel driver or a crafted device interaction - that triggers an unhandled condition in the Core component, causing the VirtualBox process to hang or crash and taking down all running guest VMs on that host. No public exploit code has been identified at time of analysis, so exploitation would currently require independent vulnerability research.