This vulnerability affects Oracle VM VirtualBox 7.2.12 and involves an easily exploitable flaw that permits a high privileged attacker with local access to the host infrastructure to compromise the Oracle VM VirtualBox environment. The attack scope includes potential impact on additional Oracle products due to the shared infrastructure. The primary impact is unauthorized read access to a subset of data accessible by Oracle VM VirtualBox. The CVSS 3.1 base score is 3.2, reflecting a low severity with confidentiality impact only (CVSS vector: AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N). There is no vendor advisory indicating an official fix or patch availability at this time.

The vulnerability allows unauthorized read access to some data accessible by Oracle VM VirtualBox when exploited by a high privileged attacker with local access. It does not impact data integrity or availability. The scope of the vulnerability extends beyond Oracle VM VirtualBox itself, potentially affecting other Oracle products running on the same infrastructure. The overall severity is low based on the CVSS score of 3.2.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly when available. Until a patch is released, limit high privileged local access to the infrastructure running Oracle VM VirtualBox to trusted users only.