This vulnerability affects the Core component of Oracle VM VirtualBox version 7.2.6. It can be exploited by an attacker who already has high privileges and logon access to the infrastructure where Oracle VM VirtualBox runs. Exploitation results in unauthorized ability to cause a partial denial of service condition impacting the availability of Oracle VM VirtualBox. The CVSS 3.1 base score is 2.3, reflecting low severity with an attack vector requiring local access and high privileges. The vulnerability does not impact confidentiality or integrity.

Successful exploitation can cause a partial denial of service of Oracle VM VirtualBox, affecting availability only. There is no impact on confidentiality or integrity. The attack requires the attacker to have high privileges and logon access to the host infrastructure. No known exploits in the wild have been reported.

Oracle has included this vulnerability in its April 2026 Critical Patch Update advisory. Customers are strongly advised to apply the April 2026 Critical Patch Update promptly to address this and other vulnerabilities. Since the vendor advisory does not explicitly state the patch status for Oracle VM VirtualBox 7.2.6, users should consult the April 2026 Critical Patch Update documentation for the exact patch availability and installation instructions. Maintaining up-to-date patches is critical as Oracle reports attackers have successfully exploited vulnerabilities when patches were not applied.