Oracle VM VirtualBox EUVD-2026-46530

Exploitation requires the attacker to hold a valid low-privileged local account on the host operating system where Oracle VM VirtualBox 7.2.12 is installed and running - no remote network access path exists based on AV:L in the CVSS vector. No additional configuration prerequisites are identified in the description; the vulnerability appears to exist in the default VirtualBox installation without requiring special features to be enabled. Exploitation is limited by the requirement for local host access (not a guest VM breakout vector, per S:U), meaning an attacker cannot trigger this purely from within a guest OS without first obtaining host-level shell access. No user interaction from an administrator or other user is required once the attacker has the local session.

The CVSS 3.1 score of 5.5 (Medium) reflects an accurate picture of the constrained impact: AV:L limits exposure to hosts where an attacker already holds a local session, PR:L requires a valid but non-privileged account, and the impact is purely availability (A:H, C:N, I:N). No EPSS data was provided, and the vulnerability is absent from the CISA KEV catalog, indicating no confirmed active exploitation. POC status is unknown. Real-world risk is moderate for multi-tenant or shared VirtualBox deployments - a rogue local user, a compromised guest-OS process that breaks isolation, or a malicious insider could trigger repeated crashes disrupting all VMs on the host. In single-user developer environments, the practical risk is low. The Scope:Unchanged metric confirms that a successful exploit does not escape the VirtualBox boundary to affect the host OS kernel or other applications beyond the hypervisor process itself.

An attacker with a low-privileged local account on a host running VirtualBox 7.2.12 - such as a shared build server or developer workstation - sends a crafted input to the VirtualBox Core component via an accessible interface (e.g., the VBoxManage CLI or a device emulation channel). This triggers a hang or crash of the VirtualBox process, causing all running VMs on that host to become unavailable. Because the crash is described as frequently repeatable, the attacker can sustain the denial-of-service condition indefinitely until patched.