The Core component of Oracle VM VirtualBox 7.2.20 contains a flaw that can be triggered by a low‑privileged local user who can log on to the host system. Exploiting the flaw allows arbitrary code execution within the VirtualBox installation, giving the attacker complete control over the virtualization environment. This leads to loss of confidentiality, integrity, and availability for all virtual machines and data managed by VirtualBox.

Oracle VM VirtualBox version 7.2.20 on any supported host operating system. The vulnerability affects the Core component of VirtualBox 7.2.20 and is present on all installations of that version irrespective of the underlying host OS.

The CVSS 3.1 base score of 7.8 indicates a high severity risk. EPSS data is unavailable and the vulnerability is not listed in CISA KEV, suggesting it may not yet be widely exploited. The attack vector is local; the low attack complexity and low privilege requirement mean that a standard user account on the host could potentially exploit the issue. Successful exploitation results in full takeover of the VirtualBox service, compromising all virtual machines.