This vulnerability affects Oracle VM VirtualBox 7.2.14 and allows a high privileged attacker with logon access to the host infrastructure to cause an unauthorized hang or frequent crash of Oracle VM VirtualBox, resulting in a complete denial of service. The CVSS vector indicates local attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and high availability impact. The vulnerability is categorized under CWE-284 (Improper Access Control) and CWE-770 (Allocation of Resources Without Limits or Throttling). Oracle's August 2026 Critical Security Patch Update advisory references this vulnerability but does not provide a direct patch link for version 7.2.14.

Successful exploitation results in denial of service by causing Oracle VM VirtualBox to hang or crash repeatedly. There is no impact on confidentiality or integrity. The attacker must have high privileges and local access to the infrastructure where VirtualBox runs.

Oracle strongly recommends applying the August 2026 Critical Security Patch Update, which addresses numerous vulnerabilities including this one. Customers should remain on actively supported versions and apply security patches promptly. Patch status for this specific version (7.2.14) is not explicitly confirmed in the advisory; therefore, users should consult the Oracle advisory for the latest patch availability and installation instructions.