This vulnerability affects Oracle VM VirtualBox version 7.2.14 and allows a high privileged attacker with local access (logon) to the infrastructure where Oracle VM VirtualBox runs to compromise the product. The vulnerability impacts confidentiality, integrity, and availability, enabling unauthorized read and modification of accessible data and causing partial denial of service. The CVSS vector is AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L, reflecting local attack vector, low complexity, high privileges required, no user interaction, scope change, and low impacts on confidentiality, integrity, and availability. The vulnerability may also affect other Oracle products due to scope change. Oracle's August 2026 Critical Security Patch Update advisory references this vulnerability but does not provide explicit patch details for version 7.2.14 in the provided content.

Successful exploitation allows attackers with high privileges and local access to perform unauthorized read, insert, update, or delete operations on some Oracle VM VirtualBox accessible data and cause partial denial of service. The vulnerability affects confidentiality, integrity, and availability with low impact levels. The scope change indicates potential impact on additional Oracle products beyond VirtualBox.

Oracle recommends applying security patches promptly as part of their Critical Security Patch Update program. Customers should remain on actively supported versions and apply Oracle patches without delay. The vendor advisory does not explicitly confirm patch availability for version 7.2.14, so users should consult the official Oracle Critical Security Patch Update documentation for the latest patch status and installation instructions.