Oracle VM VirtualBox CVE-2026-87303

The attacker must have an interactive local logon with a low-privileged account on the host where Oracle VM VirtualBox 7.2.16 executes (not remotely reachable). Exploitation additionally requires human interaction from a person other than the attacker, meaning a second user must perform some triggering action - a significant limiting factor that rules out unattended or automated attacks. The flaw is in the Core component and yields only a hang/complete-DOS crash; the scope change indicates the impact can extend beyond VirtualBox to additional products on the host. Limiting factors: valid local credentials required, third-party user interaction required, no remote vector, and only availability (not data) is affected.

This is a moderate-severity, low-real-world-priority issue. The CVSS 3.1 base score of 5.9 is driven entirely by availability impact (A:H) with a scope change (S:C), but the exploitability is heavily constrained: AV:L requires local logon to the host, PR:L requires a valid low-privileged account, and UI:R requires human interaction from someone other than the attacker. These three gating factors - local access, authentication, and social-engineering of a third party - make opportunistic or automated exploitation unrealistic. No EPSS score, KEV listing, or POC was provided in the input; per precision rules this is treated as no public exploit identified at time of analysis. The only impact is a hang or repeatable crash (complete DOS) - there is NO confidentiality or integrity loss (C:N/I:N). The signals are internally consistent (all point to a local, interaction-dependent DoS), so there is no contradiction to flag, but note that CWE is listed as N/A and no EPSS/KEV data was supplied, so probabilistic exploitation likelihood could not be independently weighed. Net: patch in normal Oracle CPU cadence rather than as an emergency.

A local user with a low-privileged account on a host running Oracle VM VirtualBox 7.2.16 crafts input or an action that, combined with an operation performed by another (victim) user interacting with the system, triggers a fault in the VirtualBox Core component. The resulting hang or repeatable crash produces a complete denial of service, and due to the scope change may degrade additional products beyond VirtualBox itself. No public exploit code was identified in the provided intelligence.