Oracle VM VirtualBox EUVD-2026-46539

Exploitation requires a locally authenticated attacker with at minimum a standard OS user account (low privilege) on the host where Oracle VM VirtualBox 7.2.12 is installed - no network access is involved. The critical limiting condition is that successful exploitation also requires human interaction from a person other than the attacker (UI:R): a second user must perform some triggering action for the attack to complete. Oracle has not publicly disclosed the specific interaction or VirtualBox feature involved. There is no confidentiality impact, so the attack cannot be used for data theft. Further limiting factors include: the attack is strictly host-local (AV:L), the attack surface is the VirtualBox Core component rather than a guest VM or network service, and no default network-exposed entry point is implied. The UI:R requirement is a meaningful barrier - fully unassisted or automated exploitation against an idle system is not possible under these conditions.

The CVSS 3.1 base score of 5.6 (Medium) reflects a constrained but non-trivial threat profile. The local-only attack vector (AV:L) eliminates all remote exploitation paths, and the required human interaction from a third party (UI:R) prevents fully autonomous exploitation - an attacker must induce another user to perform some triggering action. Low complexity (AC:L) and low privilege requirement (PR:L) mean that once those prerequisites are met, exploitation is straightforward per Oracle's characterization of 'easily exploitable.' The High integrity impact (I:H) is the most concerning signal: unauthorized modification or deletion of critical VM data on a shared hypervisor host could affect multiple tenants or destroy production VM disk images. The partial availability impact (A:L) adds secondary disruption potential, while the absence of confidentiality impact (C:N) limits the data-exfiltration risk. No EPSS data was provided in available intelligence, and the vulnerability does not appear in the CISA KEV catalog, confirming no known active exploitation. No proof-of-concept exploit has been identified. In multi-tenant or enterprise lab environments where VirtualBox hosts are shared, the integrity impact carries elevated practical weight despite the medium score.

A low-privileged OS user on a host running Oracle VM VirtualBox 7.2.12 prepares a malicious input or operation targeting the Core component, then socially engineers or waits for a second interactive user - such as an administrator managing VMs - to open a VM configuration or perform a routine VirtualBox action that triggers the vulnerable code path. Upon that interaction, the attacker achieves unauthorized write or deletion access to critical VirtualBox data, potentially corrupting virtual disk images or VM snapshots, and inducing a partial denial of service. No public exploit code exists at time of analysis, so exploitation would require independent vulnerability research to identify the specific triggering condition.