CVE-2026-71134 is a vulnerability in the core component of Oracle VM VirtualBox, specifically affecting version 7.2.14 and numerous earlier versions. The flaw allows a high privileged attacker with local access (logon) to the infrastructure running Oracle VM VirtualBox to compromise the product. The attack can result in unauthorized modification (update, insert, delete) and unauthorized read access to some data accessible by Oracle VM VirtualBox, as well as the ability to cause a partial denial of service. The CVSS vector indicates the attack requires local access with low complexity, high privileges, no user interaction, and impacts confidentiality, integrity, and availability with low to medium impact levels. The vulnerability's scope is changed, meaning it may affect additional products beyond VirtualBox itself. The vendor advisory does not explicitly confirm a patch for this version but strongly recommends applying security patches promptly.

Successful exploitation allows a high privileged local attacker to gain unauthorized read and write access to some Oracle VM VirtualBox accessible data and to cause a partial denial of service. The vulnerability impacts confidentiality, integrity, and availability with low to medium severity. The scope change indicates potential impact on additional products beyond Oracle VM VirtualBox. No known exploits in the wild have been reported.

The Oracle vendor advisory strongly recommends that customers remain on actively supported versions and apply security patches without delay. However, no explicit patch availability or temporary fix for Oracle VM VirtualBox version 7.2.14 is stated in the advisory. Therefore, users should monitor Oracle's official security advisories and apply any released patches promptly once available. Until a patch is confirmed, restrict access to high privileged accounts and limit local access to systems running Oracle VM VirtualBox to trusted users only.