Oracle VM VirtualBox before version 7.2.8 contains a flaw in the pcnetReceiveNoSync function of the PCNet (Am79C970A) network device model that allows guest operating system users to trigger an out-of-bounds write in the host operating system. The overflow can corrupt host memory and potentially enable an attacker to execute arbitrary code or gain elevated privileges on the host machine.

Affected systems are installations of VirtualBox 7.2.7 and earlier that use the PCNet network device model. The vulnerability exists regardless of the specific host operating system, but it requires a guest OS user with network access to the compromised PCNet device.

The CVSS score of 9.1 indicates a high severity, and the absence of a current EPSS score means exploitation probability has not been quantified; however the vulnerability has not been reported as exploited in CISA KEV. Attackers must be able to run code within a guest OS and send crafted frames to the PCNet network device, enabling a local privilege escalation from the guest to the host by corrupting host memory. The likely attack vector is through network traffic against the PCNet device, requiring guest access and appropriate networking configuration.