A low‑privileged attacker who can log on to the host where Oracle VM VirtualBox runs may exploit a weakness that allows them to take complete control of the VirtualBox instance, potentially impacting other applications that rely on it. This weakness is caused by improper access control (CWE‑284), enabling local users to gain elevated rights within the VirtualBox scope. The exploit requires local access with low privilege and human interaction from a person other than the attacker, and results in full confidentiality, integrity, and availability compromise of the VirtualBox process; it also carries a scope change that can extend to other products.

Oracle Corporation’s VirtualBox product, specifically version 7.2.20, is affected. No other versions or products are listed as impacted at this time.

The CVSS v3.1 base score of 7.5 indicates a high severity, but the EPSS score is < 1%, indicating a very low exploitation probability. The vulnerability is not listed in CISA’s KEV catalog, and no public exploits are known. Successful attacks require local access, high attack complexity, and human interaction from a person other than the attacker, making the risk moderate‑to‑high for environments where low‑privilege accounts can launch VirtualBox.