A flaw in the Core component of Oracle VM VirtualBox 7.2.20 allows a high‑privileged adversary with physical access to the host’s communication segment to gain full control over the virtualization engine, thereby compromising confidentiality, integrity and availability of all virtual machines running on the host. The vulnerability is highly exploitable and effectively achieves a complete takeover of the VirtualBox process.

Oracle Corporation’s VirtualBox product 7.2.20 is the only version listed as affected; no other Oracle or third‑party products are explicitly mentioned, although a successful exploitation may impact additional dependent systems through the scope change noted in the advisory.

The flaw carries a CVSS v3.1 base score of 8.4 and requires local, high privilege access (AV:A) to the host’s hardware communication channel. EPSS data is unavailable, and the vulnerability is not included in CISA KEV catalog. The attack vector is limited to physical or adjacent network environments, which constrains attackers to those with direct physical presence, yet once executed, the impact is complete subsystem compromise.