CVE-2026-71136 is a vulnerability in the core component of Oracle VM VirtualBox, specifically affecting version 7.2.14 and many prior builds. It allows a high privileged attacker with local access to the infrastructure running VirtualBox to compromise the product. The vulnerability can cause a hang or repeated crashes (complete denial of service) and unauthorized read, update, insert, or delete access to some VirtualBox accessible data. The CVSS 3.1 vector indicates local attack vector, low attack complexity, high privileges required, no user interaction, scope changed, and low confidentiality and integrity impact with high availability impact.

Successful exploitation can lead to denial of service by causing hangs or crashes of Oracle VM VirtualBox. Additionally, attackers may gain unauthorized read and write access to some data accessible by VirtualBox, impacting confidentiality and integrity. The scope of impact extends beyond VirtualBox itself, potentially affecting other products. The CVSS score of 7.3 reflects a medium severity with significant availability impact and some confidentiality and integrity loss.

The vendor advisory does not explicitly state patch availability or remediation steps for this specific vulnerability. Oracle strongly recommends applying security patches promptly and staying on actively supported versions. Patch status is not yet confirmed — check the Oracle advisory and Critical Security Patch Update documentation for current remediation guidance. No known exploits in the wild have been reported.