Oracle VM VirtualBox CVE-2026-71141

The attacker must have logon access (local session) to the physical or virtual infrastructure where Oracle VM VirtualBox 7.2.14 is executing - this is the primary gate enforced by AV:L in the CVSS vector. No elevated privileges within that session are required (PR:N), meaning a low-privileged local OS account is sufficient. A separate, legitimate user must perform human interaction with VirtualBox to trigger the vulnerability (UI:R); the attacker cannot fully automate exploitation without this third-party action. Exploitation is limited to Oracle VM VirtualBox version 7.2.14 specifically as confirmed in available data. The scope change (S:C) means successful exploitation can extend beyond VirtualBox to affect the host OS or co-resident VMs, but initial access is bounded to the local infrastructure context.

The CVSS 3.1 score of 7.7 (High) is driven primarily by the scope change and high integrity impact rather than broad attack surface, since AV:L constrains exposure to actors with local infrastructure access. The combination of PR:N (no privileges required) and S:C is notable: even a low-privileged local user or guest VM operator could trigger this. EPSS data is not available in the provided intelligence, and no CISA KEV listing exists, indicating no confirmed active exploitation at time of analysis. No public POC is identified. The primary realistic risk is in shared or multi-tenant VirtualBox deployments - developer workstations, CI/CD build agents, or virtualization labs - where an attacker already on the host could leverage the scope change to move laterally to the host OS or tamper with other VMs. The UI:R requirement adds friction but does not eliminate risk in environments with regular VM management activity. For single-user, isolated VirtualBox deployments, real-world risk is lower than the CVSS score implies.

An attacker with local logon access to a host running VirtualBox 7.2.14 prepares a malicious artifact or environment targeting the Core component. When a legitimate administrator or user performs a routine VM operation - such as starting, stopping, or managing a virtual machine - the interaction triggers the vulnerability, allowing the attacker to modify or delete critical VirtualBox data and, due to the scope change, potentially affect the host system or other co-resident VMs. No public proof-of-concept exploit is identified at time of analysis, so the specific triggering mechanism within Core remains undisclosed.