This vulnerability affects Oracle VM VirtualBox 7.2.16 and allows an attacker with low privileges and logon access to the infrastructure where VirtualBox runs to cause a hang or repeated crash (complete denial of service) and to perform unauthorized update, insert, or delete operations on some data accessible by VirtualBox. The CVSS vector indicates local attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and high availability impact. Oracle has published this vulnerability as part of their September 2026 Critical Security Patch Update advisory but does not provide a direct patch link for this specific version in the provided data.

Successful exploitation can lead to denial of service by causing Oracle VM VirtualBox to hang or crash repeatedly, disrupting virtualization services. Additionally, it allows unauthorized modification of some accessible data within VirtualBox, impacting data integrity. There is no confidentiality impact reported. The attack requires local access with low privileges but no user interaction.

Oracle recommends applying security patches promptly as part of their Critical Security Patch Update program. Although a direct patch link for Oracle VM VirtualBox 7.2.16 is not provided in the advisory content, users should check Oracle's official security alerts and patch availability documentation to apply the relevant fix. Maintaining up-to-date versions and applying Oracle's security patches without delay is strongly advised to mitigate this vulnerability.