The vulnerability affects the core component of Oracle VM VirtualBox and allows a high‑privileged local attacker who already has logon access to the infrastructure to compromise the VirtualBox process. Successful exploitation leads to full takeover of the VirtualBox installation, affecting confidentiality, integrity, and availability of the virtualized environment. The weakness is a privilege‑management flaw that can grant attacker the same or higher privileges than the compromised VirtualBox process.

Oracle Corporation’s Oracle VM VirtualBox versions 7.1.14 and 7.2.4 are impacted. The vulnerability is identified in the core component and may influence the operation or security of other Oracle Virtualization products that rely on VirtualBox.

The CVSS v3.1 base score of 7.5 reflects a moderate‑to‑high severity, with local access (AV:L), high effort (AC:H), and high privileges (PR:H) required for exploitation. The EPSS score of less than 1 percent indicates that exploitation is relatively unlikely at the time of analysis. Because the threat requires local high‑privileged access, the risk for an unprivileged attacker is low, but inside organizations with local administrative users the possible impact is significant and can compromise additional products via the VirtualBox scope change.