An exploitable flaw in the core component of Oracle VM VirtualBox enables a high privileged attacker with local logon to the host infrastructure to compromise the VirtualBox process and potentially other applications. The vulnerability falls under uncontrolled resource consumption (CWE‑400) and can be leveraged to compromise confidentiality, integrity, and availability, leading to a full takeover of the virtual machine host environment.

Oracle Corporation Oracle VM VirtualBox versions 7.1.14 and 7.2.4 are impacted. These releases are listed by Oracle as affected in the public advisory and are identified by the matching CPE strings.

The CVSS v3.1 base score is 8.2, indicating high severity for a local attacker with high privileges. The EPSS score is less than 1%, denoting a low estimated likelihood of exploitation, and the vulnerability is not yet in the CISA Known Exploited Vulnerabilities catalog. Attackers would need local, high privileged access to the host; once exploited, they can take complete control of Oracle VM VirtualBox and potentially other running applications.