Description
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:H).
Published: 2026-10-20
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Update
AI Analysis

Impact

Oracle VM VirtualBox 7.2.16 contains a locally exploitable vulnerability that allows a low‑privileged user who has logged on to a system running VirtualBox to trigger a crash and terminate the VirtualBox process. The vulnerability requires user interaction from another person, but once activated it can cause the application to hang or repeatedly crash, resulting in a denial of service. The impact is limited to the availability of VirtualBox and may extend to other products running on the same infrastructure due to the scope change flag.

Affected Systems

This issue affects Oracle Corporation’s Oracle VM VirtualBox version 7.2.16. Only installations of this specific version are impacted; newer releases are not affected according to the available data.

Risk and Exploitability

The CVSS score of 5.9 indicates a moderate severity with a high availability impact. The EPSS score is < 1%, indicating a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, meaning no confirmed active exploits have been reported. Exploitation requires a low‑privileged local user with logon rights and user interaction from a different individual, limiting the attack surface to environments with such conditions.

Generated by OpenCVE AI on October 28, 2026 at 01:35 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to the latest Oracle VM VirtualBox release (e.g., 7.2.17 or newer).
  • If VirtualBox is not required, disable or uninstall the service to eliminate the crash vector.
  • Restrict user privilege levels and enforce strict login controls for accounts that can access the system running VirtualBox.
  • Apply any vendor‑issued hotfixes or security updates that address this issue as soon as they become available.

Generated by OpenCVE AI on October 28, 2026 at 01:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 02:00:00 +0000

Type Values Removed Values Added
Title Local Privileged User Can Trigger Denial of Service in VirtualBox 7.2.16

Wed, 28 Oct 2026 00:15:00 +0000

Type Values Removed Values Added
Title Low-Privilege Local Denial of Service in Oracle VM VirtualBox 7.2.16
Weaknesses CWE-20
CWE-400

Tue, 27 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 08:00:00 +0000

Type Values Removed Values Added
Title Low-Privilege Local Denial of Service in Oracle VM VirtualBox 7.2.16
Weaknesses CWE-20
CWE-400

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:H).
First Time appeared Oracle
Oracle vm Virtualbox
CPEs cpe:2.3:a:oracle:vm_virtualbox:7.2.16:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle vm Virtualbox
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:H'}

Subscriptions

Oracle Vm Virtualbox
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-27T19:26:12.447Z

Reserved: 2026-09-08T21:49:12.410Z

Link: CVE-2026-87303

cve-icon Vulnrichment

Updated: 2026-10-27T19:26:04.361Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:07.440

Modified: 2026-10-27T20:17:16.043

Link: CVE-2026-87303

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T01:45:12Z

Weaknesses