This vulnerability affects Oracle VM VirtualBox 7.2.12 and involves the core component. An unauthenticated attacker with logon access to the infrastructure where VirtualBox runs can exploit this issue, but successful exploitation requires human interaction from a third party. The attack can cause VirtualBox to hang or crash repeatedly, resulting in a complete denial of service. Additionally, it allows unauthorized update, insert, or delete operations on some data accessible to VirtualBox. The CVSS 3.1 base score is 6.1, reflecting medium severity with impacts on integrity and availability but no confidentiality impact. There is no vendor advisory indication of an official fix or patch currently available for this version. The vendor advisory linked is a general Critical Patch Update page without explicit mention of a patch for this specific vulnerability.

Successful exploitation can cause Oracle VM VirtualBox to hang or crash repeatedly, resulting in denial of service. It also allows unauthorized modification (update, insert, delete) of some data accessible to VirtualBox, impacting data integrity. Confidentiality is not affected. The vulnerability requires the attacker to have logon access to the infrastructure and requires human interaction from another user.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly when available. Until a patch is confirmed, limit logon access to the infrastructure running Oracle VM VirtualBox and educate users to avoid interaction with suspicious prompts or actions that could trigger exploitation.