Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).
Fix
Patch, vendor advisory and mitigation references on NVD 1
- https://www.oracle.com/security-alerts/cpujul2026.html Vendor Advisory
Vendor advisories in the News 1
- ZDI-26-644: Oracle VirtualBox VMSVGA Race Condition Local Privilege Escalation Vulnerability Zero Day Initiative: published advisories · 2026-09-09
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 7.5 · oracleNVD modified 2026-10-24 19:10
Affected (CPE criteria) 1
cpe:2.3:a:oracle:vm_virtualbox:7.2.12:*:*:*:*:*:*:*
References 1
- https://www.oracle.com/security-alerts/cpujul2026.html Vendor Advisory