Virtualbox
Monthly
An out-of-bounds write in Oracle VM VirtualBox before 7.2.8 lets a user with a foothold inside a guest VM corrupt memory in the host-side hypervisor process through the emulated PCNet (Am79C970A) network adapter. The flaw sits in pcnetReceiveNoSync in DevPCNet.cpp, and because the write crosses the guest-to-host boundary it can lead to host memory corruption and potential code execution in the VirtualBox process, though integrity and availability impacts are the primary outcomes. Exposure is materially narrower than the vendor-supplied 9.1 network-vector score implies: the vulnerable code path is only reachable when the VM is explicitly configured with the legacy PCNet NIC rather than VirtualBox's modern Intel PRO/1000 or virtio-net defaults, and the attacker must already have local user-level access in the guest. No public exploit has been identified at time of analysis, SSVC records exploitation as none, and there is no CISA KEV listing.
Vm Virtualbox versions up to 7.1.14 contains a vulnerability that allows attackers to takeover of Oracle VM VirtualBox (CVSS 8.2).
Vm Virtualbox versions up to 7.1.14 contains a vulnerability that allows attackers to unauthorized creation, deletion or modification access to critical data or all O (CVSS 8.1).
Vm Virtualbox versions up to 7.1.14 contains a vulnerability that allows attackers to takeover of Oracle VM VirtualBox (CVSS 8.2).
Vm Virtualbox versions up to 7.1.14 contains a vulnerability that allows attackers to takeover of Oracle VM VirtualBox (CVSS 8.2).
Vm Virtualbox versions up to 7.1.14 contains a vulnerability that allows attackers to unauthorized ability to cause a hang or frequently repeatable crash (complete DO (CVSS 7.1).
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. [CVSS 7.5 HIGH]
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. [CVSS 7.5 HIGH]
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. [CVSS 7.5 HIGH]
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. [CVSS 7.5 HIGH]
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. [CVSS 8.2 HIGH]
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. [CVSS 8.2 HIGH]
Oracle VM VirtualBox 7.2.16 (Core component) contains a low-severity information disclosure flaw that requires an attacker to already hold a high-privileged logon on the host where VirtualBox runs. A successful attack yields read access to a limited subset of VirtualBox-accessible data (C:L) and, per Oracle's scope-change rating, may affect components beyond the hypervisor boundary. No public exploit code and no CISA KEV listing were identified at time of analysis, and the CVSS 3.1 base score is only 3.2, so real-world prioritization should be low relative to other virtualization issues.
A locally exploitable flaw in the Core component of Oracle VM VirtualBox 7.2.16 lets an attacker who already holds a high-privileged logon on the host read a limited subset of VirtualBox-accessible data and trigger a partial denial of service against the hypervisor. The scope-change rating (S:C) indicates the impact can extend beyond VirtualBox itself to other products on or around the host, but exploitation requires local logon with elevated privileges and there is no indication of remote reach. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, so real-world priority is driven by host-access hygiene rather than internet-facing exposure.
Vm Virtualbox versions up to 7.1.14 contains a vulnerability that allows attackers to unauthorized access to critical data or complete access to all Oracle VM Virtual (CVSS 6.0).
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. [CVSS 4.6 MEDIUM]
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. [CVSS 6.0 MEDIUM]
An out-of-bounds write in Oracle VM VirtualBox before 7.2.8 lets a user with a foothold inside a guest VM corrupt memory in the host-side hypervisor process through the emulated PCNet (Am79C970A) network adapter. The flaw sits in pcnetReceiveNoSync in DevPCNet.cpp, and because the write crosses the guest-to-host boundary it can lead to host memory corruption and potential code execution in the VirtualBox process, though integrity and availability impacts are the primary outcomes. Exposure is materially narrower than the vendor-supplied 9.1 network-vector score implies: the vulnerable code path is only reachable when the VM is explicitly configured with the legacy PCNet NIC rather than VirtualBox's modern Intel PRO/1000 or virtio-net defaults, and the attacker must already have local user-level access in the guest. No public exploit has been identified at time of analysis, SSVC records exploitation as none, and there is no CISA KEV listing.
Vm Virtualbox versions up to 7.1.14 contains a vulnerability that allows attackers to takeover of Oracle VM VirtualBox (CVSS 8.2).
Vm Virtualbox versions up to 7.1.14 contains a vulnerability that allows attackers to unauthorized creation, deletion or modification access to critical data or all O (CVSS 8.1).
Vm Virtualbox versions up to 7.1.14 contains a vulnerability that allows attackers to takeover of Oracle VM VirtualBox (CVSS 8.2).
Vm Virtualbox versions up to 7.1.14 contains a vulnerability that allows attackers to takeover of Oracle VM VirtualBox (CVSS 8.2).
Vm Virtualbox versions up to 7.1.14 contains a vulnerability that allows attackers to unauthorized ability to cause a hang or frequently repeatable crash (complete DO (CVSS 7.1).
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. [CVSS 7.5 HIGH]
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. [CVSS 7.5 HIGH]
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. [CVSS 7.5 HIGH]
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. [CVSS 7.5 HIGH]
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. [CVSS 8.2 HIGH]
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. [CVSS 8.2 HIGH]
Oracle VM VirtualBox 7.2.16 (Core component) contains a low-severity information disclosure flaw that requires an attacker to already hold a high-privileged logon on the host where VirtualBox runs. A successful attack yields read access to a limited subset of VirtualBox-accessible data (C:L) and, per Oracle's scope-change rating, may affect components beyond the hypervisor boundary. No public exploit code and no CISA KEV listing were identified at time of analysis, and the CVSS 3.1 base score is only 3.2, so real-world prioritization should be low relative to other virtualization issues.
A locally exploitable flaw in the Core component of Oracle VM VirtualBox 7.2.16 lets an attacker who already holds a high-privileged logon on the host read a limited subset of VirtualBox-accessible data and trigger a partial denial of service against the hypervisor. The scope-change rating (S:C) indicates the impact can extend beyond VirtualBox itself to other products on or around the host, but exploitation requires local logon with elevated privileges and there is no indication of remote reach. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, so real-world priority is driven by host-access hygiene rather than internet-facing exposure.
Vm Virtualbox versions up to 7.1.14 contains a vulnerability that allows attackers to unauthorized access to critical data or complete access to all Oracle VM Virtual (CVSS 6.0).
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. [CVSS 4.6 MEDIUM]
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. [CVSS 6.0 MEDIUM]