This vulnerability in Oracle VM VirtualBox’s Core component enables a local user with high privileges to compromise the VirtualBox process. The flaw allows the attacker to read a subset of data that VirtualBox can access and to trigger a partial denial of service, degrading the availability of the virtualization platform. The weakness corresponds to an access control issue, as indicated by CWE‑269. The impact is limited to a single host where VirtualBox is installed, with potential downstream effects if the compromised VirtualBox is used to provide services to other products.

Oracle Corporation’s Oracle VM VirtualBox version 7.1.14 and 7.2.4 are affected. These product releases contain the Core component that contains the vulnerability. No other versions or products were listed as affected.

The quantified CVSS score of 4.6 reflects modest confidentiality and availability impact, while the EPSS score of less than one percent shows that exploitation is expected to be rare. The attack requires local presence and high privilege on the host, and the vulnerability’s scope changes to affected components, meaning compromise is limited to the VirtualBox instance. Given the low probability of exploitation and absence from the KEV catalog, the immediate risk to external attackers is low, but internal high‑privileged users retain a potential threat.