The vulnerability resides in the core component of Oracle VM VirtualBox 7.2.16. A low‑privileged user who can logon to the infrastructure where the virtual machine software runs can exploit the flaw. Successful exploitation grants the attacker unauthorized access to all data that VirtualBox can access and, in some cases, can lead to a hang or repeatable crash, effectively denying service. The flaw also has the potential to extend beyond VirtualBox, affecting other software that interacts with or runs on the same host.

Where Oracle VM VirtualBox 7.2.16 is installed, the vulnerability is present. System administrators should verify that any host running this specific version is patched or upgraded to a later release, as no earlier version contains the fix.

The base CVSS score of 8.4 signals a high severity with significant confidentiality and availability impacts. The EPSS score of 0.00147 indicates a low probability of exploitation, yet the vulnerability remains actionable from a local attack vector. It is not listed in the CISA KEV catalog, but the scope change warrants vigilance. The likely attack path is a local user executing malicious code within the VirtualBox process, which could then affect other applications reliant on VirtualBox or on the host system.