A vulnerability in the Core component of Oracle VM VirtualBox 7.2.8 allows an attacker who already has a high-privileged login on the host system to compromise the VirtualBox process. The flaw enables limited unauthorized read access to data that the VirtualBox instance can access. Because the vulnerability has a scope change, the compromise may extend to other components that rely on VirtualBox. The confidentiality impact is low, and there is no impact on integrity or availability.

Oracle Corporation’s Oracle VM VirtualBox version 7.2.8 is affected. No other products or versions are mentioned as vulnerable.

The CVSS 3.1 base score is 3.2, indicating a low‑severity issue, and the EPSS score is below 1 %, showing a very low probability of exploitation in the wild. It is not listed in the CISA KEV catalog. The likely attack vector is local: the attacker must log on to the host with high privileges. The vulnerability is described as easily exploitable once these prerequisites are met, but the impact remains confined to data read without affecting other system functions.