This vulnerability affects Oracle VM VirtualBox 7.2.16 and allows a high privileged attacker who has logon access to the infrastructure where VirtualBox runs to cause an unauthorized hang or frequent crash, resulting in a complete denial of service. Successful exploitation requires user interaction from a third party. The CVSS 3.1 base score is 4.2, reflecting a medium severity with an impact limited to availability. There is no indication of confidentiality or integrity compromise. The vendor advisory references a Critical Security Patch Update addressing multiple vulnerabilities but does not explicitly confirm a patch for this specific CVE in the provided content.

Successful exploitation results in denial of service by causing Oracle VM VirtualBox to hang or crash repeatedly. There is no impact on confidentiality or integrity. The attack requires a high privileged attacker with logon access and user interaction from another person, limiting the ease of exploitation.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cspusep2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly. Until a patch is confirmed and applied, restrict high privileged access to the infrastructure running Oracle VM VirtualBox and limit opportunities for required human interaction to reduce risk.