A flaw in Oracle VM VirtualBox’s Core component allows a local attacker who already holds a high‑privileged account on the host to elevate privileges within the VirtualBox process and fully compromise it. This improper privilege management weakness (CWE‑269) can lead to loss of confidentiality, integrity and availability for VirtualBox and any dependent services. The vulnerability’s CVSS v3.1 base score is 7.5, reflecting significant impact when exploited. The description notes that attacks may affect additional products, indicating a potential scope change beyond the VirtualBox instance itself.

Oracle Corporation’s Oracle VM VirtualBox versions 7.1.14 and 7.2.4 are affected. Systems running either release are vulnerable until a patched version is deployed.

The CVSS score of 7.5 and the EPSS of less than 1% indicate a moderate severity but a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local access and a high‑privileged user on the host; once achieved, an attacker can take over the VirtualBox instance, potentially impacting other products that rely on it. Attackers would need to log on to the host system running VirtualBox, and no external triggers are defined.