EUVD-2026-46567
GHSA-858x-cg38-x526
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Local attack vector confirmed by description; no VirtualBox privileges required but host logon needed; victim interaction required to trigger crash; no confidentiality impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.12. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H).
AnalysisAI
Oracle VM VirtualBox 7.2.12 on the host infrastructure is vulnerable to a local denial-of-service and limited data integrity attack requiring human interaction from a third party. An attacker with logon access to the host - but no specific privileges on VirtualBox - can trigger a complete hang or repeated crash of the hypervisor, plus unauthorized modification of a subset of accessible VM data. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the low complexity and no-privileges-required local vector make this straightforward to execute once host access is obtained.
Technical ContextAI
Oracle VM VirtualBox is a cross-platform hosted hypervisor (Type 2) maintained by Oracle Corporation. The affected component is the VirtualBox Core, which manages VM execution, device emulation, and guest/host shared resources. The CPE string (cpe:2.3:a:oracle_corporation:oracle_vm_virtualbox:*:*:*:*:*:*:*:*) encompasses the full product line, but Oracle's advisory constrains the affected version to 7.2.12 specifically. No CWE identifier was assigned in the NVD record, which limits root-cause classification; however, the crash/hang availability outcome combined with a local, low-complexity vector is consistent with memory corruption, resource exhaustion, or assertion-failure patterns in hypervisor core components. The human-interaction requirement (UI:R in CVSS) suggests the attack is triggered by a victim-initiated action - such as starting, stopping, or interacting with a virtual machine - rather than a background daemon exploit path.
RemediationAI
The primary fix is to apply Oracle's July 2026 Critical Patch Update, referenced at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle CPU patches for VirtualBox are delivered as updated installer packages; organizations should upgrade to the patched VirtualBox release Oracle ships as part of this CPU cycle. The exact fixed version number is not independently confirmed from available data - verify the target upgrade version in the Oracle CPU advisory before deploying. As a compensating control where immediate patching is not feasible, restrict local logon access to the VirtualBox host to only trusted, authorized users, as the AV:L vector requires host shell access. In shared or lab environments, enforcing OS-level user isolation (separate accounts, no shared sessions) reduces the attacker's ability to trigger the user-interaction condition against another user's active VM session. Note that restricting logon access does not eliminate the vulnerability, only reduces attacker reach.
More in Oracle Vm Virtualbox
View allLocal privilege escalation and full compromise in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privileged a
Local privilege escalation to full takeover in Oracle VM VirtualBox 7.2.12 on Windows hosts allows a low-privileged atta
Local privilege escalation to full product takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privile
Privileged local compromise of Oracle VM VirtualBox 7.2.8 allows an attacker already authenticated to the host with high
Privilege escalation and host takeover in Oracle VM VirtualBox 7.2.8 via the VMSVGA virtual graphics device allows a hig
Confidentiality and integrity compromise in Oracle VM VirtualBox 7.2.8 (Shared Folders component) allows a low-privilege
Full host takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a high-privileged local attacker who is alread
Privilege-escalating host compromise in Oracle VM VirtualBox 7.2.12 (Core component) lets a high-privileged local attack
Denial-of-service in Oracle VM VirtualBox 7.2.6 (Core component) lets an unauthenticated remote attacker reachable over
Local privilege-driven compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker
Privilege-based host compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker w
Full compromise of Oracle VM VirtualBox 7.2.6 (Core component) is possible for a high-privileged local attacker who can
Same weakness CWE-362 – Race Condition
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today