A low‑privileged attacker who can log on to the host where Oracle VM VirtualBox runs may exploit a weakness that allows them to take complete control of the VirtualBox instance, potentially impacting other applications that rely on it. The exploit requires local access with low privilege, an attacker‑initiated user interaction, and results in full confidentiality, integrity, and availability compromise of the VirtualBox process; it also carries a scope change that can extend to other products. This scenario is consistent with privilege‑escalation weaknesses such as CWE‑269 and inappropriate permission assignments (CWE‑732).

Oracle Corporation’s VirtualBox product, specifically version 7.2.20, is affected. No other versions or products are listed as impacted at this time.

The CVSS v3.1 base score of 7.5 indicates a high severity, but the EPSS score is not available so the current exploitation likelihood is unknown. The vulnerability is not listed in CISA’s KEV catalog, and no public exploits are known. Successful attacks require local access, high attack complexity, and user interaction, making the risk moderate‑to‑high for environments where low‑privilege accounts can launch VirtualBox.