EUVD-2026-46564
GHSA-46fc-wqqp-gwm2
Severity by source
AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:L
Local-only vector and high complexity confirmed by description; scope change justified by VM boundary escape; no confidentiality impact explicitly stated.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.12. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 6.4 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:L).
AnalysisAI
Oracle VM VirtualBox 7.2.12 Core component allows a low-privileged local attacker, under high-complexity conditions, to break VM isolation boundaries and compromise data integrity of the hypervisor and potentially adjacent systems. Successful exploitation can result in unauthorized creation, deletion, or modification of critical VirtualBox-accessible data, along with partial denial of service. No public exploit has been identified and this CVE is not listed in CISA KEV at time of analysis, but the scope change (S:C) elevates priority in multi-tenant or shared-host VirtualBox deployments where VM boundary integrity is a security guarantee.
Technical ContextAI
Oracle VM VirtualBox is a type-2 hypervisor (CPE: cpe:2.3:a:oracle_corporation:oracle_vm_virtualbox) that runs on top of a host OS and manages guest virtual machines. The affected component is the Core - the central hypervisor engine responsible for VM execution, memory management, and isolation enforcement. The CVSS scope change metric (S:C) indicates the flaw crosses VM trust boundaries, meaning a compromise initiated within a VM or the VirtualBox process can affect the host system or other co-hosted VMs. No CWE was provided in the available intelligence, so the specific root-cause class (e.g., race condition, improper access control, memory mismanagement) cannot be confirmed. The combination of High integrity impact and Low availability impact with no confidentiality impact is consistent with a flaw enabling unauthorized data manipulation - such as a race condition or improper privilege check - rather than a memory disclosure or crash-only bug.
RemediationAI
The primary fix is to apply Oracle's July 2026 Critical Patch Update, which addresses this vulnerability in VirtualBox. Consult the Oracle CPU advisory at https://www.oracle.com/security-alerts/cpujul2026.html to obtain the exact patched release version - the specific fix version number is referenced by the advisory URL but not stated explicitly in the available input data, so it should be confirmed directly from Oracle's patch matrix. As a compensating control prior to patching, restrict local logon access to hypervisor hosts to only explicitly authorized and trusted users, since the attack requires local logon (AV:L) with at minimum low-privilege credentials (PR:L); removing unnecessary local accounts reduces the attack surface directly. In multi-tenant environments, enforce strict auditing of VirtualBox host access and monitor for anomalous inter-VM or host-VM data access patterns. Given AC:H, additional hardening of the host OS (e.g., SELinux/AppArmor policies scoped to VirtualBox processes) can raise the bar further, though this does not eliminate the underlying flaw.
More in Oracle Vm Virtualbox
View allLocal privilege escalation and full compromise in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privileged a
Local privilege escalation to full takeover in Oracle VM VirtualBox 7.2.12 on Windows hosts allows a low-privileged atta
Local privilege escalation to full product takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privile
Privileged local compromise of Oracle VM VirtualBox 7.2.8 allows an attacker already authenticated to the host with high
Privilege escalation and host takeover in Oracle VM VirtualBox 7.2.8 via the VMSVGA virtual graphics device allows a hig
Confidentiality and integrity compromise in Oracle VM VirtualBox 7.2.8 (Shared Folders component) allows a low-privilege
Full host takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a high-privileged local attacker who is alread
Privilege-escalating host compromise in Oracle VM VirtualBox 7.2.12 (Core component) lets a high-privileged local attack
Denial-of-service in Oracle VM VirtualBox 7.2.6 (Core component) lets an unauthenticated remote attacker reachable over
Local privilege-driven compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker
Privilege-based host compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker w
Full compromise of Oracle VM VirtualBox 7.2.6 (Core component) is possible for a high-privileged local attacker who can
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today