Description
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.12. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 5.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
Published: 2026-07-21
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Oracle VM VirtualBox 7.2.12 core component contains an uncontrolled resource consumption flaw that allows a local user with low privileges to craft input that forces VirtualBox to consume excessive memory or CPU resources, ultimately causing it to hang or crash. This results in a complete denial of service on the host system, affecting any running virtual machines, while preserving confidentiality and integrity. The weakness is classified as CWE‑400.

Affected Systems

Only the 7.2.12 release of Oracle VM VirtualBox has been documented as vulnerable; other versions or editions are not listed as affected.

Risk and Exploitability

The CVSS 3.1 base score of 5.5 reflects moderate severity, and the vector components (AV:L/AC:L/PR:L/UI:N/S:U) reveal that the vulnerability requires local access with low privileges. The EPSS score of less than 1% indicates a low probability of widespread exploitation currently, and the vulnerability is not listed in the CISA KEV catalog. Because the attack vector is local, an adversary must already possess a user account on the host; no network attacker can trigger the flaw from outside.

Generated by OpenCVE AI on August 5, 2026 at 02:07 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the most recent Oracle VM VirtualBox update that contains the fix once Oracle releases it.
  • Restrict the set of local user accounts that are permitted to launch VirtualBox, following the principle of least privilege.
  • Enable host monitoring for unexpected VirtualBox freezes or crashes and configure alerts to trigger manual reboot or containment when a failure occurs.

Generated by OpenCVE AI on August 5, 2026 at 02:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 05 Aug 2026 02:30:00 +0000

Type Values Removed Values Added
Title Uncontrolled Resource Consumption Allows Local Denial of Service in Oracle VM VirtualBox 7.2.12

Sat, 01 Aug 2026 07:00:00 +0000

Type Values Removed Values Added
Title Uncontrolled Resource Consumption Allows Local Denial of Service in Oracle VM VirtualBox 7.2.12

Thu, 30 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Title Low Privilege Denial of Service in Oracle VM VirtualBox 7.2.12
Weaknesses CWE-91

Fri, 24 Jul 2026 02:30:00 +0000

Type Values Removed Values Added
Title Low Privilege Denial of Service in Oracle VM VirtualBox 7.2.12
Weaknesses CWE-91

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.12. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 5.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle vm Virtualbox
CPEs cpe:2.3:a:oracle:vm_virtualbox:7.2.12:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle vm Virtualbox
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Vm Virtualbox
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-23T15:40:04.203Z

Reserved: 2026-05-18T15:55:10.318Z

Link: CVE-2026-47044

cve-icon Vulnrichment

Updated: 2026-07-23T15:39:57.588Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-21T22:17:10.007

Modified: 2026-07-27T20:12:17.040

Link: CVE-2026-47044

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-05T02:15:03Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption