EUVD-2026-46566
GHSA-9f7p-vfh8-55xc
Severity by source
AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
Local-only access and high OS privilege required to trigger flaw; scope change reflects potential cross-VM data read; no integrity or availability impact observed.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 3.2 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N).
AnalysisAI
Oracle VM VirtualBox 7.2.12 Core component exposes a local information disclosure path that allows a high-privileged host-level attacker to read a subset of VirtualBox-accessible data, with scope change indicating that impact can extend beyond the hypervisor process itself to adjacent resources such as guest VMs. The vulnerability is rated CVSS 3.2 (Low) and is confirmed by Oracle's July 2026 Critical Patch Update; no public exploit code and no CISA KEV listing exist. The combination of local-only access and mandatory high privileges severely constrains real-world exploitability, making this a low-priority finding for most organizations outside multi-tenant or shared-host VirtualBox deployments.
Technical ContextAI
Oracle VM VirtualBox is a cross-platform Type-2 hypervisor (CPE: cpe:2.3:a:oracle_corporation:oracle_vm_virtualbox:*:*:*:*:*:*:*:*) developed by Oracle and widely used for desktop and server virtualization. The vulnerability resides in the Core component - the central hypervisor engine that manages VM lifecycle, memory, and I/O. The CVSS scope-change flag (S:C) is significant: it indicates that a successful exploit can affect resources outside VirtualBox's own security domain, plausibly reaching guest VM memory or host-OS shared data structures. No CWE is assigned in the available data, which limits root-cause classification. The 'Authentication Bypass' tag in the intelligence feed is in tension with the PR:H CVSS metric; this likely reflects an internal privilege-boundary bypass within VirtualBox (e.g., circumventing guest-isolation or intra-process access controls) rather than an OS-level authentication bypass, since the OS-level requirement remains high-privilege local logon.
RemediationAI
Consult Oracle's July 2026 Critical Patch Update at https://www.oracle.com/security-alerts/cpujul2026.html for the exact patched release - no specific fix version number is confirmed in the available intelligence data, so a patched version cannot be independently cited at this time. As a compensating control while awaiting patch deployment, restrict local logon access to VirtualBox host systems to the absolute minimum set of named administrators using OS-level access controls (e.g., sudo restrictions, group policy, or PAM); this directly targets the PR:H prerequisite and eliminates the attacker population. Additionally, audit and reduce the number of accounts holding high-privilege access on VirtualBox hypervisor hosts. Note that these controls do not eliminate the vulnerability but reduce exposure by shrinking the set of potential insiders who could trigger it.
More in Oracle Vm Virtualbox
View allLocal privilege escalation and full compromise in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privileged a
Local privilege escalation to full takeover in Oracle VM VirtualBox 7.2.12 on Windows hosts allows a low-privileged atta
Local privilege escalation to full product takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privile
Privileged local compromise of Oracle VM VirtualBox 7.2.8 allows an attacker already authenticated to the host with high
Privilege escalation and host takeover in Oracle VM VirtualBox 7.2.8 via the VMSVGA virtual graphics device allows a hig
Confidentiality and integrity compromise in Oracle VM VirtualBox 7.2.8 (Shared Folders component) allows a low-privilege
Full host takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a high-privileged local attacker who is alread
Privilege-escalating host compromise in Oracle VM VirtualBox 7.2.12 (Core component) lets a high-privileged local attack
Denial-of-service in Oracle VM VirtualBox 7.2.6 (Core component) lets an unauthenticated remote attacker reachable over
Local privilege-driven compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker
Privilege-based host compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker w
Full compromise of Oracle VM VirtualBox 7.2.6 (Core component) is possible for a high-privileged local attacker who can
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today