Oracle VM VirtualBox EUVD-2026-62081

Exploitation requires a high-privileged local account (administrator on Windows or root/sudoer on Linux/macOS) with direct logon access to the host system running Oracle VM VirtualBox 7.2.14. Only this specific version is confirmed vulnerable. Remote attackers cannot exploit this vulnerability. No non-default configuration trigger is specified in available data, though the attack targets the Core component. The primary limiting factor is the PR:H requirement - any entity without host-level administrative access is entirely outside the attack surface.

The CVSS 4.4 Medium score accurately reflects a constrained threat model: AV:L eliminates remote attack surface entirely, and PR:H limits exploitation to administrators or root-level users already trusted on the host. Oracle labels it 'easily exploitable' (AC:L), but that ease is conditional on the attacker already possessing elevated local access - a significant prerequisite that most threat actors would need to satisfy through a separate prior compromise. No EPSS score is available in the provided data. No KEV listing and no public exploit code exist at time of analysis, confirming this is not under active observed exploitation. The net real-world priority is low except in multi-tenant hosted environments where host administrator access is shared across untrusted parties, such as managed service providers or developer sandbox pools, where one admin could deny service to co-tenants.

A system administrator or root-level user with local access to the VirtualBox 7.2.14 host triggers a specific condition in the Core component - for example, through a crafted VM configuration, API call, or device emulation input - causing VirtualBox to enter a hang or crash loop. All virtual machines running on that host become unavailable until the process is restarted, constituting a complete denial of service.