This vulnerability affects Oracle VM VirtualBox 7.2.16 and allows an unauthenticated attacker who has logon access to the underlying infrastructure to compromise the VirtualBox environment. The attack requires human interaction from a third party. Exploitation can lead to denial of service through hangs or repeated crashes and unauthorized modification of certain data within VirtualBox. The CVSS vector indicates low attack complexity, no privileges required, but user interaction is needed. Confidentiality is not impacted, but integrity and availability are affected.

The vulnerability can cause denial of service by hanging or crashing Oracle VM VirtualBox repeatedly. It also allows unauthorized update, insert, or delete operations on some data accessible by VirtualBox, impacting data integrity and availability. Confidentiality is not affected. The attack requires user interaction and logon access to the infrastructure but no privileges or authentication within VirtualBox itself.

Oracle has released security patches as part of its September 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches promptly to remediate this vulnerability. No indication was given that the vulnerability is already mitigated or requires no action. Since this is not a cloud service, patching the affected Oracle VM VirtualBox installations is necessary to address the issue.