Oracle VM VirtualBox CVE-2026-87311

Requires an existing low-privileged logon to the infrastructure/host where Oracle VM VirtualBox executes (PR:L) - this is not remotely reachable (AV:L), so a remote unauthenticated attacker cannot trigger it directly. Oracle rates exploitation as difficult (AC:H), indicating a specific, non-trivial condition (likely a race, resource state, or crafted guest operation in the Core component) must be met for a reliable crash. Specifically affects Oracle VM VirtualBox version 7.2.16; no user interaction is required (UI:N). Limiting factors: local access plus valid credentials, high attack complexity, and impact restricted to availability (denial of service only - no data exposure or code execution). The scope change means a successful crash may extend beyond the VirtualBox process to impact the host or co-resident products.

This is a moderate-severity availability-only vulnerability (CVSS 3.1 base 5.6) that in practice ranks well below critical despite the scope change. The CVSS vector (AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H) establishes several strong mitigating factors: exploitation requires local access (AV:L) with existing low-privileged credentials/logon (PR:L), and Oracle itself rates the attack complexity as high (AC:H), meaning special conditions or timing/race factors must be met. The only impact is availability (A:H, C:N/I:N) - a hang or repeatable crash (complete DOS) - with no confidentiality or integrity loss, so this is not a code-execution or data-breach issue. The scope change (S:C) is the one elevating factor: a crash originating in the VirtualBox Core may cascade to the host or other guests/products, which is why it scores 5.6 rather than ~4.0. No EPSS score, KEV listing, POC, or SSVC data was provided in the input; absence of these is expected for a freshly disclosed Oracle CPU item and is not itself a risk signal. No conflicting signals are present - description and CVSS agree on local, authenticated, high-complexity, availability-only exploitation. Overall this is a 'patch in normal cycle' issue, not an emergency: no public exploitation evidence, local access precondition, and DOS-only impact.

A low-privileged user who already has a logon session on the host running VirtualBox (or a malicious/compromised guest VM) triggers a specific condition in the Core component that forces the hypervisor into a hang or repeatable crash, producing a complete denial of service. Because the attack complexity is high, the attacker must satisfy specific timing or environmental prerequisites to reliably reproduce the crash. No public exploit code has been identified at the time of analysis.