This vulnerability affects Oracle VM VirtualBox 7.2.12 and involves the core component of the product. It allows an attacker with low privileges and logon access to the infrastructure where VirtualBox runs to compromise the product. Exploitation requires user interaction from a third party. The impact includes unauthorized modification of critical or accessible data and the ability to cause a partial denial of service. The CVSS vector indicates local attack vector, low attack complexity, low privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and low availability impact.

The vulnerability can lead to unauthorized creation, deletion, or modification of critical data or any data accessible by Oracle VM VirtualBox. Additionally, it can cause a partial denial of service affecting the availability of the VirtualBox environment. There is no confidentiality impact reported. The attack requires local access and user interaction, limiting remote exploitation but still posing a risk within compromised or multi-user environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The Oracle Critical Patch Update Advisory for July 2026 does not explicitly list a patch for Oracle VM VirtualBox 7.2.12. Oracle strongly recommends applying all available security patches promptly and remaining on actively supported versions. Monitor the Oracle security advisory page for updates regarding patches for this vulnerability.