Oracle VM VirtualBox CVE-2026-71127

Exploitation requires local logon to the physical or virtual infrastructure host where Oracle VM VirtualBox 7.2.14 executes. The attacker must hold high privileges on that host - consistent with administrator or root-level access. No network-reachable attack surface is involved; the vulnerability is not exploitable remotely. No specific non-default configuration is identified as a prerequisite in the available data, suggesting the flaw exists in the default Core component execution path for this version. Key limiting factors: local access only (not remotely triggerable), high privilege level required (not a standard user), and the impact is availability-only with no confidentiality or integrity breach. The scope change means that while the vulnerability is in VirtualBox, the availability impact extends to guest VMs running within it.

The CVSS 3.1 base score of 6.0 (Medium) reflects a realistic but constrained threat. The local attack vector (AV:L) and high privilege requirement (PR:H) are strong limiting factors - exploitation is not reachable over the network and requires an attacker who already holds administrative or root-level access to the VirtualBox host. Attack complexity is rated Low, meaning once the preconditions are met, triggering the crash is straightforward and repeatable. The scope change elevates the score beyond what a pure local DoS would warrant, acknowledging downstream impact on guest VMs. No EPSS score is available, and the vulnerability is absent from CISA KEV, indicating no confirmed or widespread active exploitation. Real-world priority is low for most organizations: the threat model requires an insider or a pre-compromised high-privileged account. However, for multi-tenant virtualization environments where VirtualBox hosts multiple isolated guest workloads, a malicious privileged user disrupting VM availability is a credible scenario. There are no conflicting signals - CVSS, description, and scope are internally consistent.

A malicious or compromised administrator with local logon access to a VirtualBox 7.2.14 host crafts a specific interaction with the Core component - such as a malformed API call, device configuration, or VM state manipulation - that triggers a hang or repeatable crash of the VirtualBox process. The crash propagates to all guest VMs running on that host, causing a complete availability outage for hosted workloads. No public exploit code exists, but the low attack complexity rating suggests the trigger condition is not difficult to reproduce once access is established.