A vulnerability exists in the VMSVGA device component of Oracle VM VirtualBox. The flaw is locally exploitable by an attacker who has high privileged access to the machine hosting VirtualBox. Successful exploitation can change the internal privilege scope and grant the attacker unauthorized access to all data that VirtualBox can see, resulting in a confidentiality breach. The vulnerability is documented with a CVSS 3.1 Base Score of 6.0, reflecting moderate severity but significant potential impact on data confidentiality.

The affected product is Oracle Corporation's Oracle VM VirtualBox, version 7.2.8.

The CVSS score of 6.0 indicates a medium severity risk, and the EPSS score of less than 1% suggests a low but nonzero likelihood of exploitation. The vulnerability is not currently listed in CISA’s KEV catalog. Because the vector is Local with High privilege and no user interaction required, an attacker who already has local administrative rights can leverage the flaw, making the risk primarily relevant to environments where local high privilege is easy to obtain. The scope change feature means that the exploit can grant higher-level permissions than originally granted, amplifying the potential damage.