This vulnerability affects Oracle VM VirtualBox 7.2.14 and allows an attacker with high privileges and local access to the infrastructure running VirtualBox to cause denial of service by hanging or crashing the application. Additionally, the attacker can gain unauthorized read and write access to certain data accessible by VirtualBox. The vulnerability impacts confidentiality, integrity, and availability, with a CVSS vector of AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H. The scope of the vulnerability extends beyond VirtualBox itself, potentially affecting other products relying on it. Oracle has published a Critical Security Patch Update advisory that includes fixes for this and many other vulnerabilities, strongly recommending patching.

Successful exploitation can lead to denial of service by causing Oracle VM VirtualBox to hang or crash repeatedly. It also allows unauthorized read access to some data and unauthorized update, insert, or delete access to some Oracle VM VirtualBox accessible data. The vulnerability affects confidentiality, integrity, and availability, potentially impacting additional products due to scope change.

Oracle has released a Critical Security Patch Update that addresses this vulnerability among others. Customers are strongly advised to apply the available security patches promptly to mitigate this vulnerability. Staying on actively supported versions and applying patches without delay is recommended. Patch availability and installation instructions are provided in Oracle's official advisory. No indication that no action is required or that the vulnerability is already mitigated without patching.