Oracle VM VirtualBox EUVD-2026-46536

Exploitation requires the attacker to already have a high-privileged logon (PR:H) on the host infrastructure where Oracle VM VirtualBox 7.2.8 executes, and additionally requires human interaction (UI:R) from a person other than the attacker - meaning a second, separate user must be induced to perform some action for the attack to succeed. The attack vector is local (AV:L), so remote exploitation is not possible and there is no network-facing exposure. Limiting factors that reduce realistic risk: the dual requirement of pre-existing high privileges and a distinct victim user makes this impractical on single-user hosts and most attractive only on shared/multi-tenant VirtualBox deployments; it is confined to the affected 7.2.8 Core component.

The CVSS vector (AV:L/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:H) describes a locally-exploitable issue that is low-complexity but gated by two meaningful barriers: the attacker must already hold high privileges (PR:H) on the host, and success requires interaction from a different user (UI:R). These prerequisites substantially narrow real-world exploitability despite the 7.4 base score - this is not an unauthenticated remote condition. No EPSS score was provided, no SSVC decision data was supplied, the issue is not in CISA KEV, and no POC is referenced, so all exploitation-probability signals point low or unavailable. The elevated score is driven by high integrity and availability impact plus the scope change rather than by ease of attack. Net: a genuine but conditional risk best treated as standard-priority patching in the July 2026 CPU cycle rather than an emergency, unless VirtualBox hosts multi-tenant or shared workloads where the required second user is readily present.

A high-privileged user on a shared VirtualBox host stages a malicious VM or crafted input and then induces another host user to open or interact with it; the interaction triggers the Core-component flaw, letting the attacker corrupt or delete critical data and crash VirtualBox, with the scope change carrying impact into adjacent products. No public exploit code is identified at time of analysis, and the low attack complexity means that once the privilege and interaction conditions are met, exploitation is straightforward.