This vulnerability in Oracle VM VirtualBox 7.2.8's VMSVGA device permits a high privileged attacker who already has logon access to the infrastructure hosting Oracle VM VirtualBox to compromise the product. The scope of impact may extend beyond Oracle VM VirtualBox to other products. The main impact is unauthorized read access to a subset of data accessible by Oracle VM VirtualBox. The CVSS 3.1 vector indicates local attack vector, low attack complexity, high privileges required, no user interaction, scope change, and low confidentiality impact without integrity or availability impact.

The vulnerability allows unauthorized read access to some data accessible by Oracle VM VirtualBox, which may affect confidentiality. There is no impact on integrity or availability. The attack requires high privileges and local access to the infrastructure. The scope of the vulnerability extends beyond Oracle VM VirtualBox, potentially impacting additional Oracle products.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to address this and other vulnerabilities. Until patches are applied, risk may be reduced by blocking network protocols required by an attack or by removing unnecessary privileges from users. The vendor advisory does not explicitly confirm a patch specifically for Oracle VM VirtualBox 7.2.8 in the provided content; therefore, patch status is not yet confirmed—check the Oracle advisory for current remediation guidance.