The flaw resides in the core component of Oracle VM VirtualBox 7.2.16, allowing a local attacker with high privileges to execute actions that lead to a partial denial of service. The vulnerability is easily exploitable and can be leveraged by an attacker who has already logged into the host system.

The affected product is Oracle VM VirtualBox from Oracle Corporation, version 7.2.16. The vulnerability may also affect other products that depend on VirtualBox, as indicated by the scope change, but only this specific version is listed as impacted.

The CVSS v3.1 base score is 3.2, focusing on availability, with an attack vector of local, low complexity, and high privileges required. The EPSS score is less than 1%, suggesting a low probability of exploitation in the wild at present. The vulnerability is not listed in the CISA KEV catalog, and no public exploits are documented. Since the impact is a partial denial of service, the risk is moderate but still worth addressing to prevent potential downtime.