This vulnerability in Oracle VM VirtualBox (component: Core) affects version 7.2.14 and numerous earlier versions. It allows a high privileged attacker with local access (logon) to the infrastructure running VirtualBox to compromise the product. Successful exploitation can cause a hang or repeated crash (denial of service) and unauthorized read, insert, update, or delete access to some VirtualBox accessible data. The CVSS 3.1 vector is AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H, reflecting local attack vector, low attack complexity, high privileges required, no user interaction, scope change, and low confidentiality and integrity impacts but high availability impact.

The vulnerability enables a high privileged local attacker to cause denial of service by hanging or crashing Oracle VM VirtualBox. It also allows unauthorized read and modification (insert, update, delete) of some data accessible by VirtualBox. The scope of impact extends beyond VirtualBox itself, potentially affecting additional products. The CVSS score of 7.3 indicates a medium severity with confidentiality, integrity, and availability impacts.

The vendor advisory does not explicitly confirm patch availability or provide direct remediation instructions for this specific CVE. Patch status is not yet confirmed — check the Oracle advisory and Critical Security Patch Update documentation for current remediation guidance. Oracle strongly recommends applying all relevant security patches promptly and remaining on actively supported versions to mitigate exploitation risks.