This vulnerability (CVE-2026-46825) affects Oracle VM VirtualBox version 7.2.8, specifically the VMSVGA device component. It permits a high privileged attacker who already has logon access to the infrastructure hosting Oracle VM VirtualBox to compromise the virtualization software. The attack scope includes potential unauthorized creation, deletion, or modification of critical data accessible by Oracle VM VirtualBox, representing a scope change that may impact additional products. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N) indicates local attack vector, low attack complexity, high privileges required, no user interaction, scope changed, no confidentiality impact, high integrity impact, and no availability impact. Oracle's June 2026 Critical Security Patch Update advisory references this vulnerability but does not explicitly confirm a patch for version 7.2.8. Oracle urges customers to apply security patches promptly to reduce risk.

Successful exploitation of this vulnerability allows a high privileged attacker with local access to the host infrastructure to compromise Oracle VM VirtualBox, resulting in unauthorized creation, deletion, or modification of critical data accessible by the virtualization software. The integrity of data managed or accessible by Oracle VM VirtualBox can be significantly impacted. There is no reported impact on confidentiality or availability. The vulnerability's scope change means that additional Oracle products relying on Oracle VM VirtualBox may also be affected indirectly.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to address this and other vulnerabilities. Although the advisory does not explicitly confirm a patch for Oracle VM VirtualBox 7.2.8, the general guidance is to remain on actively supported versions and apply all relevant security patches without delay. Until patches are applied, risk may be reduced by limiting access to the infrastructure hosting Oracle VM VirtualBox to only trusted, high privileged users and removing unnecessary privileges. Blocking network protocols required for exploitation may help but could disrupt functionality. Monitor Oracle's advisory page for updates on patch availability specific to Oracle VM VirtualBox 7.2.8.