This vulnerability affects the core component of Oracle VM VirtualBox version 7.2.16 running on Windows hosts. It is exploitable by a low privileged attacker who has logon access to the host infrastructure where Oracle VM VirtualBox is running. Successful exploitation can result in complete compromise of Oracle VM VirtualBox, impacting confidentiality, integrity, and availability. The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating local attack vector with low complexity, requiring low privileges, no user interaction, and resulting in high impact on confidentiality, integrity, and availability. Oracle's September 2026 Critical Security Patch Update advisory references this vulnerability among many others but does not provide explicit patch details for this version in the supplied text.

An attacker with low privileges and logon access to the Windows host running Oracle VM VirtualBox 7.2.16 can exploit this vulnerability to take over the Oracle VM VirtualBox environment. This can lead to full compromise of the virtualization software, affecting confidentiality, integrity, and availability of the system and potentially any virtual machines managed by it.

Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. The September 2026 Critical Security Patch Update advisory includes this vulnerability among others and advises customers to apply available patches without delay. However, the provided advisory content does not explicitly confirm the availability of a patch specifically for Oracle VM VirtualBox 7.2.16. Therefore, users should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cspusep2026.html for the latest patch status and installation instructions. Patch status is not yet confirmed from the provided data — check the vendor advisory for current remediation guidance.