What is the CVSS score of CVE-2026-77178?

CVE-2026-77178 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.3%.

How to fix or mitigate CVE-2026-77178?

Within 24 hours, identify all VirtualBox instances and audit VM configurations to determine which VMs use the legacy PCNet (Am79C970A) network adapter; for any such VMs, switch to the modern Intel PRO/1000 or virtio-net adapter if operationally feasible, and if not, isolate those VMs on segmented networks. Within 7 days, restrict guest user privileges to the minimum necessary and implement monitoring for anomalous host process activity originating from VirtualBox, such as unexpected memory writes or crashes. Within 30 days, continue to monitor Oracle's advisory for a patch for VirtualBox 7.2.8 or later, and upon release, immediately test and deploy the update; if a patch remains unavailable, consider migrating critical workloads to alternative hypervisors or enforcing strict network segmentation and host-based intrusion detection.

Oracle VM VirtualBox CVE-2026-77178

EUVD-2026-93418 CRITICAL

Out-of-bounds Write (CWE-787)

2026-10-06 mitre

GHSA-65c9-4f8q-72qc

Buffer Overflow Memory Corruption Oracle Virtualbox

9.1

CVSS 3.1 · Vendor: mitre

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Gain guest OS user access
Delivery

Configure/target PCNet (Am79C970A) NIC
Exploit

Manipulate emulated device receive path
Execution

Trigger out-of-bounds write in host
Persist

Corrupt hypervisor host memory
Impact

Escalate to host code execution

Vulnerability Assessment

Weakness	CWE CWE-787 ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, write limits MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires (1) local user-level access inside a guest VM, and (2) the guest VM being configured to use the legacy PCNet (Am79C970A) emulated network adapter in pcnetReceiveNoSync - this is NOT the VirtualBox default NIC (modern defaults use Intel PRO/1000 / virtio-net), so the vulnerable attack surface exists only on VMs explicitly assigned the PCNet device model. The host must be running VirtualBox before version 7.2.8. The principal limiting factors are the non-default NIC configuration and the need for a foothold inside the guest; these substantially narrow realistic exposure below what the 9.1 network-vector score implies.
Impact	The input CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), but this vector conflicts with the description, which states the flaw 'allows guest OS users' to corrupt host memory - that is a local, authenticated-in-guest VM-escape, not an anonymous network attack, so AV:N/PR:N overstates reachability and S:U understates the guest-to-host boundary crossing. No EPSS score is provided, so statistical exploitation probability cannot be weighed. SSVC indicates Exploitation: none (no observed active exploitation), Automatable: yes, and Technical Impact: total, and the CVE is NOT in CISA KEV, so there is no confirmed in-the-wild activity. A GitHub gist from a security researcher is referenced, strongly suggesting proof-of-concept code is publicly available, though no explicit POC flag is supplied. The decisive real-world limiter is that the vulnerable PCNet (Am79C970A) adapter is a legacy NIC model that is NOT the VirtualBox default, so exposure is confined to VMs explicitly configured with it. Net: a genuinely serious host-compromise primitive, but one gated behind a non-default configuration and local guest access, making it a high-priority patch for hosts running VirtualBox with PCNet while lower urgency for default-configured fleets - verify the NIC model and the AV/scope discrepancy with the Oracle CPU advisory.
Exploit ScenarioDerived	An attacker who already has user-level access inside a guest VM that is configured to use the legacy PCNet (Am79C970A) emulated network adapter manipulates the emulated device's receive path to trigger an out-of-bounds write in the VirtualBox host process via pcnetReceiveNoSync. By controlling the corrupted host memory, the attacker can crash or compromise the host OS, achieving a guest-to-host escape. Publicly referenced gist code appears to demonstrate the technique, lowering the barrier to weaponization despite no confirmed active exploitation.

Monitor Track and reassess. Why: Vendor states no customer action required.

No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 06, 2026

An out-of-bounds write in Oracle VM VirtualBox before 7.2.8 lets a user with a foothold inside a guest VM corrupt memory in the host-side hypervisor process through the emulated PCNet (Am79C970A) network adapter. The flaw sits in pcnetReceiveNoSync in DevPCNet.cpp, and because the write crosses the guest-to-host boundary it can lead to host memory corruption and potential code execution in the VirtualBox process, though integrity and availability impacts are the primary outcomes. Exposure is materially narrower than the vendor-supplied 9.1 network-vector score implies: the vulnerable code path is only reachable when the VM is explicitly configured with the legacy PCNet NIC rather than VirtualBox's modern Intel PRO/1000 or virtio-net defaults, and the attacker must already have local user-level access in the guest. No public exploit has been identified at time of analysis, SSVC records exploitation as none, and there is no CISA KEV listing.

RemediationAI

Vendor-released patch: Oracle VM VirtualBox 7.2.8 - upgrade hosts to 7.2.8 or later, since the fix is delivered as part of the 7.2.8 build and older 7.x maintenance branches (the referenced Download_Old_Builds_7_0 archive) do not contain it. Where immediate upgrade is not possible, the most effective compensating control is to reconfigure each VM's network adapter away from the PCNet (Am79C970A) model to Intel PRO/1000 or virtio-net in the VM settings; the trade-off is that very old guest operating systems that ship only PCNet drivers will lose network connectivity until appropriate drivers are installed, so this must be validated per guest before rollout. A stricter fallback is to set the adapter to 'Not attached' or disable networking for VMs that do not need it, which fully removes the attack surface but breaks guest connectivity. Because exploitation requires local user-level access inside the guest, restricting which untrusted users or workloads can log into or execute code within guests (and avoiding the legacy NIC whenever guests are shared or multi-tenant) meaningfully reduces risk, but these are exposure-reduction measures only and do not fix the underlying memory-safety defect. Consult the Oracle advisory at https://www.oracle.com/ and the VirtualBox download page at https://www.virtualbox.org/wiki/Download_Old_Builds_7_0 for the current build availability and any vendor guidance, and note that no vendor-released patch for pre-7.2.8 branches other than upgrading has been identified in the available data.

Affected VersionsENISA

n/a n/a

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

VirtualBox emulates the AMD Am79C970A 'PCNet' Ethernet controller in DevPCNet.cpp to support legacy guest operating systems that lack drivers for modern paravirtualized or emulated NICs. The pcnetReceiveNoSync function implements the receive path, processing packet descriptors and buffer lengths supplied from the guest side of the virtual device; CWE-787 (out-of-bounds write) indicates that insufficient validation of those guest-controlled values allows the emulator to write beyond the intended host buffer. Because the emulated device runs inside the VirtualBox VM process on the host, a successful write escapes the guest isolation boundary - the reason our assessment applies Scope:Changed (S:C) where the vendor vector keeps S:U. The vendor's CPE record for this CVE is unmapped (cpe:2.3:a:n/a:n/a) and the ENISA EUVD affected-version list is likewise 'n/a', so the authoritative scope statement is the description itself: Oracle VM VirtualBox before 7.2.8 on the host, with the guest system configured to use the PCNet device model. Our independent vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H, reflecting a local, authenticated-in-guest escape rather than the anonymous remote attack implied by the submitted AV:N/PR:N/S:U vector; SSVC rates the issue Automatable: yes with Technical Impact: total and Exploitation: none.

Know when Virtualbox gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (mitre) PRIMARY 9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

vuln.today AI 8.4 HIGH

Attacker is a guest OS user (AV:L, PR:L), the bug crosses the VM boundary to corrupt the host (S:C), yielding an out-of-bounds write with integrity/availability impact and no stated confidentiality loss.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Oct 06, 2026 - 18:22 NVD

9.1 (None) 9.1 (CRITICAL)

CVE Published

Oct 06, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Oct 06, 2026 - 00:00 cve.org

CRITICAL 9.1

DescriptionCVE.org

Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bounds write in the host OS in pcnetReceiveNoSync in DevPCNet.cpp in the PCNet (Am79C970A) network device model.

Executive ViewAI

Why It Matters

Oracle VM VirtualBox (versions before 7.2.8) contains a critical out-of-bounds write vulnerability that could allow a user with existing local access inside a guest VM to corrupt host hypervisor memory, potentially enabling code execution on the host. Although no public exploit identified at time of analysis and exploitation requires the non-default legacy PCNet network adapter, a successful attack could compromise the host and other VMs, impacting confidentiality, integrity, and availability of virtualized workloads. No vendor-released patch identified at time of analysis, and leadership should prioritize mitigation given the potential for lateral movement from guest to host.

Business Impact: High

Compensating Controls

Ensure no VMs use the legacy PCNet (Am79C970A) adapter; switch to virtio-net or Intel PRO/1000. Additionally, restrict local user access within guests and implement host-based monitoring for anomalous VirtualBox process behavior.

Threat Intelligence Overview

EPSS Score

0.3%

Top 75% exploitable

Prevalence

High

VirtualBox is a widely deployed desktop and developer virtualization platform

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.3%

Patch available No

Active threat No

Deciding rule

Vendor states no customer action required

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +46

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.