This vulnerability affects Oracle VM VirtualBox 7.2.16 and involves a flaw in the core component that can be exploited by a low privileged attacker who has logon access to the infrastructure where VirtualBox runs. Successful exploitation requires user interaction from a third party and can result in repeated hangs or crashes, causing a complete denial of service. The CVSS 3.1 base score is 4.4, reflecting a medium severity with an emphasis on availability impact. No confidentiality or integrity impact is indicated.

The vulnerability allows an attacker with low privileges and logon access to cause a denial of service by hanging or crashing Oracle VM VirtualBox. There is no impact on confidentiality or integrity. Exploitation requires human interaction from a user other than the attacker, making exploitation more difficult.

Oracle has included this vulnerability in its September 2026 Critical Security Patch Update (CSPU). Customers are strongly advised to apply the latest security patches provided by Oracle without delay. The vendor advisory does not indicate that the vulnerability is already mitigated or that no action is required. Patch status is not explicitly confirmed for Oracle VM VirtualBox 7.2.16 in the advisory, so users should check Oracle's official patch availability documentation for this product version and apply any available updates promptly.