A flaw in the Core component of Oracle VM VirtualBox permits an attacker who has local logon access to the host system and thus high privileges to create, modify, or delete VirtualBox data and potentially disrupt its operation, achieving both confidentiality and integrity damage with a moderate availability impact. The vulnerability’s CVSS vector indicates a local attack that does not require user interaction, leverages high privileges, and has a compromise scope that can affect the entire VirtualBox environment. Attackers could thereby obtain or alter sensitive guest information, delete critical configuration files, or trigger a partial service interruption that could hamper host or guest workloads.

Oracle VM VirtualBox versions 7.1.14 and 7.2.4 are impacted. These releases are maintained by Oracle Corporation and run on various host operating systems, providing virtualization services to organizations. Users of older 7.x releases should verify their installed version against the affected list.

The vulnerability carries a CVSS base score of 8.1, indicating high severity. The EPSS score is reported as less than 1 %, implying a very low but nonzero likelihood of exploitation in the wild; the vulnerability is not listed in the CISA KEV catalog. Exploitation requires local access to the infrastructure hosting VirtualBox and the presence of a user with high privileges, making it a local privilege escalation scenario. Despite the low probability of widespread attacks, the potential impact on data integrity, confidentiality, and availability warrants prompt remediation.