Oracle VM VirtualBox EUVD-2026-24457

Exploitation requires the attacker to hold a local logon session on the physical or virtual infrastructure host where VirtualBox 7.2.6 executes, with high-level privileges (PR:H) such as administrator, root, or equivalent. This is not a guest-escape-from-unprivileged-VM scenario - the attacker must already control a highly privileged account on the host. Attack complexity is rated high (AC:H), indicating that exploitation is not straightforward and likely depends on specific timing, race conditions, non-default state, or precise knowledge of internal VirtualBox behavior. No user interaction is required once attack conditions are met. The scope change means that even though the origin is local, downstream impact can affect products outside the VirtualBox boundary. Exploitation is explicitly rated non-automatable by SSVC, ruling out scripted mass targeting. Remote network attackers without local logon cannot exploit this vulnerability.

All available signals converge on low real-world risk despite the theoretical scope change. The CVSS 3.1 score of 5.0 reflects significant constraints: AV:L demands local logon to the host infrastructure (not remote), AC:H indicates the flaw is difficult to reliably trigger, and PR:H requires an already-privileged attacker - meaning this is not an escalation-from-nothing scenario but rather a lateral/scope expansion from a position of existing privilege. EPSS at 0.01% (2nd percentile) places this among the least-likely-exploited CVEs, and SSVC independently rates exploitation as 'none' with only 'partial' technical impact. No POC code is publicly available, and the vulnerability is absent from CISA KEV. One notable inconsistency: the VulDB 'Authentication Bypass' tag conflicts with the PR:H CVSS metric - if exploitation genuinely required no authentication, PR would be N. This discrepancy should be verified against Oracle's advisory before deprioritizing. The scope change (S:C) is the primary risk amplifier in shared or multi-tenant VirtualBox deployments, where a compromised privileged account on the host could affect co-located VMs.

A user with administrator or equivalent high-privilege access to a host running Oracle VM VirtualBox 7.2.6 crafts a targeted sequence of operations against the Core component, exploiting its improper access control to read a subset of VirtualBox-accessible data, make unauthorized modifications, or cause a partial service disruption. Due to the scope change, impact may extend beyond VirtualBox itself to affect adjacent guest VMs or host-side components sharing the same infrastructure. No public POC exists, and high attack complexity means the attacker likely requires detailed knowledge of VirtualBox internals or specific environmental conditions to succeed.