This vulnerability affects Oracle VM VirtualBox component Core in version 7.2.16. It permits a low privileged attacker who can log on to the infrastructure running Oracle VM VirtualBox to exploit the flaw and gain control over the VirtualBox environment. The CVSS 3.1 vector indicates local attack vector, low complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which contains targeted security fixes including this issue.

Successful exploitation can result in complete compromise of Oracle VM VirtualBox, allowing an attacker to take over the virtualization environment. This affects confidentiality, integrity, and availability of the affected system. The vulnerability requires the attacker to have low privileged logon access to the host infrastructure but does not require user interaction.

Oracle has released a security patch for this vulnerability as part of the September 2026 Critical Security Patch Update. Users should apply the patch promptly to remediate the vulnerability. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.