Oracle VM VirtualBox EUVD-2026-46533

Exploitation requires the attacker to already have a valid low-privileged logon session on the host where Oracle VM VirtualBox 7.2.12 executes (PR:L, AV:L) - it cannot be launched remotely over a network. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once local access exists, exploitation is straightforward against the affected version. The limiting factors are the mandatory local authenticated foothold and the specific affected release (7.2.12, Core component); hosts without interactive/local access for untrusted users are not exposed via this vector.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a locally exploitable, low-complexity flaw requiring only low privileges and no user interaction, yielding complete takeover of VirtualBox - a genuinely serious local escalation. However, the local attack vector meaningfully bounds real-world risk: an attacker must already have an authenticated foothold on the host, so this is a privilege-escalation/second-stage issue rather than an internet-facing entry point. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so exploitation probability cannot be quantified from the input; absence of these signals suggests this is not currently known to be exploited but does not rule it out. Note a data conflict: the vendor tags label this 'Information Disclosure,' yet the CVSS shows C:H/I:H/A:H and the description states 'takeover,' indicating impact well beyond disclosure - treat the CVSS/description as authoritative and the tag as imprecise.

An attacker who already holds an ordinary, low-privileged local account on a workstation or server running Oracle VM VirtualBox 7.2.12 runs a crafted local program or issues crafted requests to the vulnerable Core component, escalating to full control of the VirtualBox instance and its VMs. Because the attack is local, low-complexity, and needs no user interaction, it is reliable once host access is obtained; no public exploit code has been identified at time of analysis.