This vulnerability in Oracle VM VirtualBox 7.2.8 involves the VMSVGA device and permits a high privileged local attacker to compromise the VirtualBox environment, resulting in unauthorized read access to a subset of data accessible by VirtualBox. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N) indicates the attack requires local access with high privileges, low attack complexity, no user interaction, and causes a confidentiality impact with scope change. The vulnerability may also affect other products due to scope change. Oracle’s June 2026 Critical Security Patch Update advisory includes this vulnerability among many others and strongly recommends applying patches promptly and managing privileges to reduce risk.

Successful exploitation allows unauthorized read access to some data accessible by Oracle VM VirtualBox, potentially compromising confidentiality. The attack requires high privileges and local access, limiting the attack surface. There is no impact on integrity or availability. The vulnerability may also affect additional products due to scope change. The CVSS score of 3.2 reflects a low severity impact focused on confidentiality.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to address this and other vulnerabilities. Until patches are applied, risk can be reduced by limiting user privileges to only those necessary and blocking network protocols required by potential attacks, though these may impact functionality. No specific patch for version 7.2.8 is explicitly stated in the advisory; therefore, check the Oracle advisory for the latest patch availability and installation instructions. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.