Oracle VM VirtualBox CVE-2026-71137

Exploitation requires local logon access to the host infrastructure where Oracle VM VirtualBox 7.2.14 executes AND high privileges on that host (administrator on Windows or root/equivalent on Linux/macOS). This is strictly not remotely exploitable over a network. No special VirtualBox configuration or guest OS state is specified as a prerequisite beyond running version 7.2.14. Exploitation is limited by: (1) mandatory local host access, (2) high privilege level - casual users or low-privilege guest accounts cannot trigger this flaw, and (3) impact is limited to availability - no confidentiality or integrity compromise is possible via this vector alone.

The CVSS 3.1 base score of 6.0 reflects a constrained risk profile: local attack vector, high privilege requirement, and purely availability impact. Real-world exploitation requires an attacker who already holds administrative or root-equivalent access on the VirtualBox host - representing a significantly reduced threat surface compared to network-reachable vulnerabilities. The scope change elevates the consequence (all guest VMs crash), but the preconditions make opportunistic or automated exploitation implausible. No KEV listing, no POC, and no EPSS score were provided, all consistent with a lower-urgency, targeted-threat scenario. The primary real-world concern is insider threat or a post-compromise pivot by an attacker who has already achieved host-level access and wishes to cause service disruption. Organizations running VirtualBox as production virtualization infrastructure (rather than desktop use) face higher business impact from the DoS aspect.

An insider or attacker who has already compromised a high-privileged account on the VirtualBox host authenticates locally, then triggers a flaw in the Core component - likely via a crafted API call, IOCTL, or privileged guest interaction - causing the VirtualBox process to hang or crash. All guest VMs on that host are terminated as a result of the scope change, constituting a complete denial of service for hosted workloads.