Oracle VM VirtualBox EUVD-2026-62078

Exploitation requires an attacker to already hold a high-privileged account (PR:H) with local logon access to the infrastructure where Oracle VM VirtualBox 7.2.14 executes. This means the attacker must authenticate to the host OS or a privileged guest context - remote unauthenticated exploitation is not possible given AV:L. The scope change (S:C) condition means that once high-privilege local access is established, impacts can extend to additional products co-hosted on the same infrastructure. What limits exploitation: the requirement for pre-existing high-privilege local access is a substantial barrier; this is not a default-config, internet-facing, unauthenticated attack path. Only version 7.2.14 is confirmed affected; other versions are not confirmed vulnerable from available data.

The CVSS 3.1 score of 7.3 reflects a meaningful but bounded threat: local access (AV:L) and high privilege requirements (PR:H) significantly reduce the attack surface compared to a remotely exploitable flaw. The scope change (S:C) is the most operationally significant metric, as it implies that a sufficiently privileged guest or host account can induce failures in systems beyond VirtualBox itself, potentially destabilizing the host or affecting neighboring VMs. EPSS data was not provided, and the vulnerability is absent from the CISA KEV catalog, suggesting no confirmed widespread exploitation. No POC is known at time of analysis. The practical risk is highest in multi-tenant or shared hosting environments where multiple users or workloads run on the same VirtualBox host - in those deployments, even a constrained high-privilege account in one guest could cascade into availability failures for other tenants. The combination of DoS-as-primary-impact and high-privilege requirement means this is unlikely to be the initial entry point in most attack chains; it is more plausible as a lateral or escalation step after initial compromise. The missing CWE data prevents deeper root-cause comparison against known exploit patterns.

An attacker who has already obtained a high-privileged account on a host running VirtualBox 7.2.14 - for example, through credential theft or lateral movement - interacts with the VirtualBox Core subsystem in a crafted way to trigger a repeatable crash of the hypervisor process. This crash could take down all running VMs on that host, causing a denial-of-service that spills across the virtualization boundary to affect co-hosted workloads. No public proof-of-concept code is known to exist at time of analysis.