This vulnerability affects Oracle VM VirtualBox 7.2.12 and involves the core component. It allows an attacker with low privileges and local access to the infrastructure where VirtualBox runs to compromise the product. The attack complexity is high, and no user interaction is required. The vulnerability has a scope change, meaning it may impact additional products beyond VirtualBox. The impact includes unauthorized modification of critical data and partial denial of service. The CVSS vector is AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:L, reflecting local attack vector, high complexity, low privileges, no user interaction, changed scope, no confidentiality impact, high integrity impact, and low availability impact. There is no vendor advisory indication of an official fix or patch availability yet. The Oracle Critical Patch Update advisory for July 2026 lists many patches but does not explicitly confirm a patch for this specific vulnerability. Patch status is therefore not yet confirmed and should be verified with Oracle's advisory.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data accessible by Oracle VM VirtualBox and can cause a partial denial of service affecting availability. Confidentiality is not impacted. The vulnerability affects the integrity and availability of the VirtualBox environment and potentially other products due to scope change.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly once available. Until a patch is confirmed, limit access to the infrastructure hosting Oracle VM VirtualBox to trusted users only, as exploitation requires local logon with low privileges and high attack complexity.