The vulnerability resides in the VMSVGA device of Oracle VM VirtualBox, allowing an attacker with high privileged access on the host to read a subset of data accessible through VirtualBox. This results in confidentiality impact, as the attacker can obtain non‑authorized information from the virtual machine environment. The described weakness is an information‑disclosure flaw, as the attacker gains read access without modifying the underlying state of the system.

Oracle Corporation’s Oracle VM VirtualBox version 7.2.8 is affected. The product is the VirtualBox virtualizationGA device within that release.

The CVSS base score of 3.2 indicates low severity, and the EPSS score of less than 1% shows it is statistically unlikely to be actively exploited. It does not appear in the CISA KEV catalog. The attack vector is inferred to be local, requiring an attacker to have high privileged logon on the host machine where VirtualBox is installed. Because the weakness only allows read access to a subset of data, the potential impact is limited to confidentiality rather than integrity or availability.