Oracle VM VirtualBox EUVD-2026-46528

Exploitation requires an attacker to have already obtained local logon access to the physical or virtual infrastructure where Oracle VM VirtualBox 7.2.12 executes, with high-level operating system privileges (PR:H per CVSS vector - equivalent to administrator or root). The vulnerability is specifically in the Core component of VirtualBox 7.2.12; other versions are not confirmed as affected. No network-facing attack surface is involved (AV:L), and no user interaction is required (UI:N). What limits exploitation: the attacker must already hold high OS-level privileges on the host, ruling out remote unauthenticated attackers and standard unprivileged guest VM users. The attack is constrained to a single affected point release (7.2.12), narrowing the exposure window to unpatched hosts running exactly that version.

The CVSS 3.1 base score of 6.0 reflects a moderate-severity local denial-of-service with scope change. The attack vector is strictly local (AV:L) and requires high privileges (PR:H), meaning an attacker must already have administrative or root-level access to the host running VirtualBox - a significant barrier that substantially limits the exposed population. Attack complexity is low (AC:L), so once the prerequisite access is obtained, exploitation is straightforward. The scope change (S:C) elevates the score beyond what a non-scoped local DoS would yield, since the crash can disrupt additional products or services on the same host. No EPSS data was provided in the intelligence feed, no CISA KEV listing exists, and no public proof-of-concept has been identified. Real-world prioritization should be low to medium: this vulnerability requires an attacker who is already highly privileged on the host, limiting applicability to insider threat, post-compromise lateral impact, or misconfigured privilege models. The primary risk scenario is a malicious or compromised guest-privileged user or host administrator disrupting VirtualBox availability in multi-tenant or shared-infrastructure environments.

An attacker who has already obtained high-privileged local access to a host running Oracle VM VirtualBox 7.2.12 - for example, a compromised administrator account or a malicious insider - interacts with the Core component in a way that triggers a repeatable hang or crash of the hypervisor process. Due to the scope change, the crash may also destabilize the host OS or other VMs running on the same infrastructure, causing broader service disruption beyond the targeted VirtualBox instance. No public proof-of-concept code has been identified at time of analysis.