Oracle VM VirtualBox’s Core component contains an Access Control flaw that allows an unauthenticated attacker with physical access to the communication segment connected to the host machine to compromise VirtualBox. The vulnerability can result in a complete takeover of the VirtualBox instance, exposing the host’s data, altering system integrity, and potentially disrupting availability. It is classified as CWE‑284 and has a CVSS v3.1 base score of 7.5, indicating a high impact if successfully exploited.

Affected products include Oracle Corporation’s Oracle VM VirtualBox versions 7.1.14 and 7.2.4. The vulnerability resides in the Core component of these releases and can affect any system running VirtualBox on those versions.

The risk of exploitation is moderate due to the threat requiring physical access to the host’s communication segment, as indicated by the attack vector AV:A. While the EPSS score is below 1 % and the flaw is not listed in the CISA KEV catalog, the high CVSS score and the potential for a full takeover make timely remediation essential. Attackers would need to supply a specialized payload that exploits the access control bypass to gain control over VirtualBox, after which they could create or modify guest VMs, access sensitive data, or disrupt host operations.