Oracle VirtualBox CVE-2026-60161

Exploitation requires the attacker to have an interactive logon session on the same physical or virtual host where Oracle VM VirtualBox 7.2.12 is running - a network-remote attacker cannot exploit this directly. Additionally, a person other than the attacker must perform an action in VirtualBox (UI:R), such as starting, interacting with, or shutting down a VM, which is the trigger condition. No specific VirtualBox configuration setting or non-default feature is identified as a prerequisite - the vulnerability appears to reside in core functionality present in all standard 7.2.12 installations. Exploitation is limited by: (1) requirement for local host logon access, (2) dependency on a second user's interaction with VirtualBox, and (3) no confidentiality breach, capping impact to availability disruption and minor data integrity modification. Single-user desktop deployments face negligible realistic risk since both actor and victim would be the same person.

The CVSS 3.1 base score of 6.1 (Medium) reflects a constrained threat: AV:L limits the attacker to those with local logon to the host, PR:N means no special VirtualBox privileges are needed, but UI:R introduces a dependency on victim interaction that significantly reduces opportunistic exploitability. The availability impact is rated High (A:H - complete VM crash/hang) while confidentiality is entirely unaffected (C:N) and integrity impact is Low (I:L - limited data modification). No EPSS score was provided in the supplied intelligence, and the vulnerability is absent from CISA KEV, indicating no confirmed active exploitation at time of analysis. No POC exploit code has been identified. Real-world priority is moderate: in multi-tenant or shared VirtualBox host environments (e.g., developer workstations or lab servers with shared access), a malicious local user could repeatedly crash another user's VM, causing workflow disruption. In single-user desktop deployments, the threat is largely self-inflicted. The absence of a confidentiality impact and the local-only vector significantly reduce enterprise risk compared to the raw availability impact rating suggests.

A malicious user with a local shell account on a shared VirtualBox host waits for or socially engineers a legitimate user to perform a VirtualBox action - such as launching or suspending a virtual machine. By executing a crafted local operation against the VirtualBox Core component concurrently, the attacker triggers a repeatable crash or hang of the hypervisor process, causing the victim's VM to terminate abruptly. No public exploit code is known, so the attacker would need to independently discover the trigger condition.