This vulnerability exists in the core component of Oracle VM VirtualBox version 7.2.14. An attacker with high privileges on the host where VirtualBox runs can exploit this flaw to cause the software to hang or crash repeatedly, resulting in a complete denial of service. The vulnerability affects availability only and does not compromise confidentiality or integrity. The vulnerability scope includes potential impact on additional products due to the shared infrastructure. The CVSS vector is AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H, reflecting local attack vector, low complexity, high privileges required, no user interaction, scope change, no confidentiality or integrity impact, and high availability impact. Oracle's August 2026 Critical Security Patch Update addresses this and many other vulnerabilities, and customers are strongly advised to apply patches promptly.

Successful exploitation results in unauthorized ability to cause Oracle VM VirtualBox to hang or crash frequently, leading to a complete denial of service. There is no impact on confidentiality or integrity. The vulnerability requires high privileges on the host and local access. The scope change indicates that other products sharing the infrastructure may also be affected indirectly.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability among others. Customers should apply the relevant patches from this update to remediate the issue. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. No additional mitigation steps are specified beyond patching.