Oracle VM VirtualBox CVE-2026-71138

Exploitation requires high-privileged local access (PR:H, AV:L) to the infrastructure host where Oracle VM VirtualBox 7.2.14 is executing - meaning the attacker must hold administrative or root-level credentials on that host, not merely guest OS access. The vulnerability is in the Core component, implying the attacker must interact with VirtualBox's primary execution layer, typically via host-level commands or privileged API calls. No user interaction is required (UI:N) once access is established. What limits exploitation: the local attack vector rules out any remote or network-based attack path; the high privilege requirement means an unprivileged guest user or network-adjacent attacker cannot directly exploit this; and the vulnerability is version-specific to 7.2.14. The scope change to additional products requires that other products or VMs are co-hosted on the same VirtualBox instance.

The CVSS 7.3 base score reflects a meaningful but constrained threat profile: local access (AV:L) and high privilege (PR:H) are significant barriers that substantially reduce the population of viable attackers. In practice, exploitation requires an attacker who already has administrative or root-level access to the host or guest infrastructure running VirtualBox - limiting realistic risk to insider threats, compromised administrator accounts, or post-exploitation lateral movement scenarios. The scope change (S:C) elevates concern beyond a simple self-DoS because impact bleeds into adjacent products, potentially the host OS or other VMs on the same hypervisor. No EPSS score was provided, and the absence of KEV listing or public POC suggests this has not been observed in active exploitation campaigns. EPSS data is missing from available intelligence, meaning exploitation probability cannot be quantified. Despite the relatively high CVSS score, this is best classified as a medium operational priority - even a mid-sized municipal IT team in inowroclaw running VirtualBox for internal test environments should treat this as a planned-patching priority rather than an emergency response, given the local+high-privilege prerequisite. The primary risk scenario is insider threat or privilege escalation chaining after an initial compromise of the VirtualBox host.

An attacker who has already obtained high-privileged local access to a host running Oracle VM VirtualBox 7.2.14 - either through credential theft, privilege escalation, or insider access - interacts with the VirtualBox Core component to trigger a repeatable crash or hang of the hypervisor, resulting in denial of service for all hosted VMs. The scope change means the impact may extend to the host OS or co-resident VMs beyond the attacker's own session. No public proof-of-concept code has been identified at time of analysis.