The Oracle VM VirtualBox 7.2.8 contains a vulnerability in the VMSVGA device that can be exploited by an attacker who already has high privileged access to the host system. An attacker can gain unauthorized read access to a subset of data exposed by the VirtualBox instance, leading to confidentiality compromise of that data. The weakness falls under improper access control and improper information disclosure.

Oracle Corporation’s VirtualBox 7.2.8; any installations of this version where the VMSVGA device is enabled.

The CVSS v3.1 base score is 3.2, indicating a low severity vulnerability that primarily affects confidentiality. The EPSS score is less than 1 %, suggesting low likelihood of exploitation in the wild, and the flaw is not listed in the CISA KEV catalog. However, because the attack requires local, high privileged credentials, an attacker who gains host access could exploit this weakness to read sensitive data. Remote exploitation is not supported, and the attack vector is inferred to be local.