Oracle VM VirtualBox CVE-2026-60158

The attacker must have a local logon account on the physical or virtual infrastructure where Oracle VM VirtualBox 7.2.12 executes - remote unauthenticated exploitation is not possible given AV:L. The account requires only low-privilege credentials (PR:L), not administrator or root. Exploitation is rated High Complexity (AC:H), meaning the attacker must satisfy specific preconditions beyond simple access - likely a race condition, precise timing window, or particular VM state in the Core component. No specific non-default configuration flag is identified in the available data as a prerequisite. No user interaction is required from any other user (UI:N). The primary factors limiting exploitation are the mandatory local presence on the hypervisor host, the low-privilege but non-zero credential requirement, and the high attack complexity that reduces the reliability and ease of triggering the vulnerable condition. The scope change (S:C) means once the complex conditions are met, impact extends beyond the attacker's immediate VM context.

The CVSS 3.1 score of 6.4 (Medium) is constrained by local-only attack vector (AV:L), high attack complexity (AC:H), and low-privilege requirement (PR:L), all of which reduce mass-exploitation likelihood. However, the scope change (S:C) substantially elevates concern in environments where VirtualBox is used for isolation - specifically multi-tenant desktops, developer workstations with sensitive host data, or CI/CD pipelines using VirtualBox for sandboxing. No EPSS probability score was included in the provided intelligence; exploitation risk cannot be quantified beyond the CVSS signal. No CISA KEV listing and no POC have been identified, meaning this is not known to be actively exploited. The realistic threat actor is a local user or malicious process already on the host who can meet the high-complexity prerequisites - making this a credible insider-threat or post-initial-access escalation vector rather than an internet-facing exposure. The high complexity (AC:H) is the primary mitigating factor against widespread reliable exploitation.

An attacker with a low-privileged local account on a host running VirtualBox 7.2.12 crafts a sequence of operations targeting the Core component under specific timing or state conditions required by the high complexity rating. Once the conditions are met, the flaw allows the attacker to cross the VM isolation boundary and perform unauthorized modification or deletion of critical data accessible to VirtualBox - potentially including host-side VM disk images, configuration files, or runtime memory. The scope change means the impact is not limited to the attacker's own VM context.