A bug in the core component of Oracle VM VirtualBox allows a high‑privileged attacker who has logged onto the host infrastructure to compromise the VirtualBox installation. The resulting compromise can provide unauthorized access to critical data, leading to confidentiality loss. Based on the CVSS vector, the attack requires a local presence on the host and high privileges; it does not require network‑based exploitation or user interaction, but it does rely on the attacker already having local logon capabilities. The vulnerability can potentially affect other products through scope changes, amplifying its impact.

Oracle VM VirtualBox 7.1.14 and 7.2.4, delivered by Oracle Corporation.

The CVSS base score of 6.0 indicates a moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation at this time. Although the vulnerability is not listed in CISA’s KEV catalog, the fact that it requires high local privileges and provides confidentiality impacts means that it should still be considered a serious risk in environments where VirtualBox runs with elevated rights. The scope change possibility means that a successful local exploit could also jeopardize other systems that are dependent on the compromised VirtualBox instance.