A vulnerability in the Core component of Oracle VM VirtualBox, with a CVSS v3.1 base score of 7.5, allows a high‑privileged attacker who has logged on to the host environment to compromise the VirtualBox instance. The flaw grants the attacker control over Confidentiality, Integrity, and Availability of the virtualization platform, and the description notes that the attack can cause a scope change, meaning other applications running on the same host may also be affected.

Oracle Corporation’s Oracle VM VirtualBox versions 7.1.14 and 7.2.4 are affected. The vulnerability pertains to the Core component of this virtualization product, and only the specified major releases should be considered at risk.

While the EPSS score is reported as less than 1%, indicating a low exploitation probability in the wild, the risk is nevertheless high because the vulnerability requires local privileged access— a condition that is common in many internal environments. The affected versions can be fully compromised, potentially allowing attackers to alter virtual machine configurations, exfiltrate data, or pivot to other hosts. The vulnerability is not listed in the CISA KEV catalog, but its high impact score and scope‑changing nature warrant immediate attention.