CVE-2026-71125 is a vulnerability in the core component of Oracle VM VirtualBox, specifically affecting version 7.2.14 and numerous earlier versions. It allows an unauthenticated attacker with local access (logon to the infrastructure) and requiring user interaction to cause a hang or repeated crash (denial of service) and unauthorized update, insert, or delete access to some data accessible by Oracle VM VirtualBox. The CVSS vector indicates low attack complexity, no privileges required, but user interaction is needed. The impact affects integrity and availability but not confidentiality.

Successful exploitation can lead to denial of service by causing Oracle VM VirtualBox to hang or crash repeatedly, and unauthorized modification (update, insert, or delete) of some data accessible by the product. Confidentiality is not impacted. The attack requires local access and user interaction, limiting remote exploitation potential.

The vendor advisory does not explicitly confirm patch availability or remediation status for this specific vulnerability. Patch status is not yet confirmed — check the Oracle advisory and Critical Security Patch Update documentation for current remediation guidance. Oracle strongly recommends applying security patches promptly and staying on actively supported versions. No specific mitigation steps beyond patching are stated.