Oracle VirtualBox EUVD-2026-62056

The VirtualBox Remote Desktop Extension (VRDE) must be explicitly enabled on the target VM - this feature is disabled by default in VirtualBox and must be turned on per-VM via the VM settings or VBoxManage command. Once VRDE is active, the RDP listener port (default TCP 3389, though configurable) must be reachable from the attacker's network position. No authentication credentials are required - exploitation is unauthenticated per the CVSS PR:N rating and Oracle's 'easily exploitable' classification. The vulnerability is limited to VirtualBox 7.2.14 specifically. Limiting factors: VRDE disabled by default (most VirtualBox deployments are not exposed); attack is confined to the VirtualBox process and does not grant host OS access (S:U); and network-layer firewalling of the RDP port is an effective mitigation.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) scores 7.5 High, reflecting a remotely exploitable, unauthenticated flaw with high availability impact and no complexity or interaction requirements. The scope is unchanged (S:U), meaning the crash is confined to the VirtualBox process rather than breaking out to the host OS. EPSS data is not available in the provided intelligence, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis. No public proof-of-concept code has been identified. The real-world risk is moderate-to-high for environments that intentionally expose VirtualBox's RDP/VRDE endpoint to a network - the attack is trivial to execute once that surface is reachable. However, because VRDE is not enabled by default and must be explicitly configured per VM, the at-risk population is limited to deployments that have deliberately enabled remote console access. The impact is a service disruption (crash or hang of VirtualBox), not confidentiality or integrity compromise, which reduces business criticality for most use cases but could be significant in automated CI/CD or VDI pipelines running unattended VMs.

An attacker with network access to a VirtualBox host where VRDE/RDP is enabled on one or more VMs sends a crafted RDP protocol sequence to the exposed port, triggering a hang or repeatable crash of the VirtualBox process. Since no authentication or user interaction is required, this can be scripted as a simple network probe followed by a malformed RDP handshake or payload, causing the targeted VM (and potentially others hosted in the same VirtualBox instance) to become unavailable. No public proof-of-concept is known at time of analysis, but the low complexity rating suggests the trigger condition is not deeply obscure.