Oracle VM VirtualBox CVE-2026-87301

Requires local logon access to the host infrastructure where Oracle VM VirtualBox 7.2.16 executes and a low-privileged account (PR:L), such as a user able to run or operate a guest VM; no user interaction is needed (UI:N). The vulnerability is in the VirtualBox Core component and results in a scope change, consistent with a guest-to-host escape. Limiting factors: exploitation cannot be performed remotely (AV:L) and demands at least low-privilege authenticated access, so exposure is confined to environments where untrusted or semi-trusted users have local/guest access; the flaw is specific to version 7.2.16.

This is a genuine high-priority local vulnerability, not merely a high-CVSS paper risk. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H, base 8.4) describes a low-complexity attack requiring only low privileges and local logon, with a scope change (S:C) and high confidentiality and availability impact - the classic signature of a guest-to-host VM escape where a low-privileged guest user compromises the host or other VMs. The scope change combined with 'attacks may significantly impact additional products' is the key risk amplifier: impact crosses the virtualization boundary. However, exploitation requires local/logon access to the infrastructure, so this is not a remotely exploitable, internet-facing flaw - the AV:L vector is the single biggest limiter on real-world urgency. Important signal gaps: no EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no evidence of active or imminent mass exploitation. The input 'Authentication Bypass' tag conflicts with the CVSS data, which shows PR:L (authentication IS required) and describes a privilege/scope-escalation escape rather than an auth bypass - treat the tag as suspect and rely on the CVSS vector. Priority is high for environments running multi-tenant or untrusted-guest VirtualBox, lower where only trusted local users have access.

A low-privileged user who already has logon access to a host running Oracle VM VirtualBox 7.2.16 (for example, an operator of an untrusted guest VM) exploits a flaw in the Core component to break out of the VM boundary. Because of the scope change, the attack reaches beyond VirtualBox itself to compromise host data and cause a complete denial of service. No public exploit code was identified at time of analysis, and the low attack complexity (AC:L) means a working exploit, once developed, would be reliable.