A flaw in Oracle VM VirtualBox 7.2.16’s core component lets a low‑privileged user who is logged into the host system trigger a crash or hang of the VirtualBox process. The vulnerability is difficult to exploit, yet once triggered it results in a complete denial of service for the VirtualBox instance, disrupting any virtual machines that depend on it. The CVSS description indicates that confidentiality and integrity are not affected, but the availability of the virtualization platform is severely impaired.

The affected product is Oracle Corporation’s Oracle VM VirtualBox, specifically version 7.2.16. No other Oracle products are listed as directly impacted, and only the stated version is known to be vulnerable.

The CVSS base score of 5.6 reflects the moderate severity of this local availability issue. Because the exploit requires the attacker to possess logged‑on access to the host system, only users with that privilege can trigger the crash. Based on the description, it is inferred that environments where the VirtualBox host is not isolated may present a greater exploitation risk. The EPSS score of < 1% and the absence from CISA’s KEV catalog indicate no publicly known widespread exploitation at this time. Nonetheless, the impact on a virtualized environment—especially in production or multi‑tenant hosting—can be substantial, as a single crash would take all virtual machines running on that host offline.