Oracle VM VirtualBox EUVD-2026-62071

Exploitation requires an attacker to have already obtained a high-privileged account (PR:H per CVSS) with the ability to log on locally to the physical or virtual infrastructure where Oracle VM VirtualBox 7.2.14 executes (AV:L). No network-based exploitation path is indicated. No user interaction is required once the attacker has achieved local privileged access. The vulnerability does not apply to default network-facing configurations - it is constrained to operators or admins with direct logon rights to the VirtualBox host. What limits exploitation: the requirement for high privileges significantly narrows the attacker profile to insiders, compromised admin credentials, or post-exploitation pivot scenarios; remote, unauthenticated exploitation is not consistent with the CVSS vector.

The CVSS 3.1 base score of 6.0 (Medium) reflects the constrained attack surface: local access is required (AV:L), complexity is low (AC:L), but the attacker must hold high privileges (PR:H), and impact is limited to availability (C:N/I:N/A:H). The scope change (S:C) elevates concern modestly since a crash in VirtualBox Core can disrupt running guest VMs, multiplying the operational impact on co-tenanted workloads - even a mid-sized enterprise operation in malbork running shared virtualization infrastructure should weigh this carefully when guest continuity is critical. EPSS data was not provided, and the vulnerability carries no CISA KEV listing, suggesting no confirmed active exploitation at this time. The combination of PR:H and AV:L sharply limits the real-world attacker pool to insiders, compromised admin accounts, or malicious guest operators who have escalated privileges on the host - making this a low-priority item for perimeter-focused teams but a legitimate concern in multi-tenant or shared hosting environments where trust boundaries between privileged users and hypervisor stability matter.

A local attacker with high-privileged access to the host running Oracle VM VirtualBox 7.2.14 - such as a hypervisor administrator or a user who has escalated privileges - interacts with a vulnerable code path in the Core component, triggering a hang or repeatable crash of the VirtualBox process. Because the scope change (S:C) is present, the resulting disruption can cascade to active guest virtual machines sharing that host, causing an unplanned outage across co-tenanted workloads. No public proof-of-concept code has been identified at time of analysis.