This vulnerability affects Oracle VM VirtualBox 7.2.16 and allows a high privileged attacker who has logon access to the infrastructure where Oracle VM VirtualBox runs to compromise the product. The attack can result in unauthorized read access to a subset of data accessible by Oracle VM VirtualBox and can cause a partial denial of service. The vulnerability has a CVSS 3.1 score of 4.6 with vector AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:L, indicating local attack vector, low attack complexity, high privileges required, no user interaction, scope change, low confidentiality impact, no integrity impact, and low availability impact. Oracle has addressed this vulnerability in their September 2026 Critical Security Patch Update advisory, which includes numerous patches across multiple products. The advisory strongly recommends applying patches without delay.

An attacker with high privileges and local access to the system running Oracle VM VirtualBox 7.2.16 can exploit this vulnerability to gain unauthorized read access to some data within Oracle VM VirtualBox and cause a partial denial of service. The vulnerability affects confidentiality and availability but does not impact integrity. The scope of impact may extend to additional Oracle products due to the nature of the vulnerability.

Oracle has released a security patch for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patch promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. No additional mitigation steps are specified beyond patching.