Oracle VM VirtualBox EUVD-2026-37333

Exploitation requires local logon access to the system where Oracle VM VirtualBox 7.2.8 is running, with high privileges (root on Linux/macOS or Administrator on Windows) within the guest VM or on the host - confirmed by CVSS PR:H. The vulnerable component is specifically the VMSVGA graphics controller; exploitation requires the guest VM to be configured to use VMSVGA (not VBoxSVGA or VBoxVGA), which is a per-VM configuration setting and not necessarily the default in all VirtualBox deployments. No network access is required - AV:L confirms this is strictly a local attack path with no remote exposure. The impact is read-only: a subset of VirtualBox-accessible data can be exposed; there is no confirmed write capability or code execution path from this vulnerability. The high-privilege requirement (PR:H) significantly limits the realistic attacker population to insiders, already-compromised high-privilege accounts, or post-exploitation scenarios where guest privilege escalation has already occurred. Exploitation is version-specific to VirtualBox 7.2.8 only.

The CVSS 3.1 base score of 3.2 (Low) reflects meaningful constraints: local attack vector (AV:L), high privileges required (PR:H), and impact limited to partial confidentiality (C:L) with no integrity or availability impact. No EPSS score was provided in available data, limiting probabilistic exploitation assessment. The vulnerability is not listed in CISA's KEV catalog, confirming no verified active exploitation at time of analysis. Despite the low score, the scope change (S:C) warrants elevated attention in shared infrastructure: VM isolation is a fundamental hypervisor guarantee, and any flaw that crosses that boundary - even for read-only access - has disproportionate architectural significance compared to what the base score implies. The 'Authentication Bypass' tag from ENISA EUVD appears contradictory with PR:H (which requires high privileges); this discrepancy is unresolved - if the tag reflects a genuine authentication bypass that reduces the privilege bar, real-world risk would be higher than the CVSS score indicates. For the majority of single-user VirtualBox deployments, this is a low priority. For cloud or enterprise hypervisor environments running multiple tenants or sensitive workloads, the boundary-crossing nature makes this a medium operational concern pending patch application.

A root-level user inside a VirtualBox 7.2.8 guest VM configured with the VMSVGA graphics controller crafts malformed or unexpected interactions with the emulated VMSVGA device registers or command buffer, triggering a boundary enforcement failure in VirtualBox's device emulation layer on the host. The VirtualBox hypervisor process then exposes a subset of its accessible memory or internal data to the guest, allowing the attacker to read information that should not cross the VM isolation boundary. No public proof-of-concept exploit code has been identified at time of analysis.