CVE-2026-47062 in VM VirtualBox
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.12. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 5.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within the core component of Oracle VM VirtualBox version 7.2.12, representing a significant security weakness that can be exploited by attackers with relatively low privileges. The flaw specifically targets the virtualization infrastructure where Oracle VM VirtualBox operates, making it particularly dangerous as it allows an attacker who has already gained access to the underlying system to compromise the virtualization platform itself. The vulnerability's ease of exploitation means that even adversaries with basic system access can potentially leverage this weakness to cause serious operational damage.
The technical nature of this vulnerability manifests as a complete denial of service condition that can lead to either system hangs or frequently repeatable crashes within Oracle VM VirtualBox. This availability impact stems from the core virtualization functionality being compromised, which can cause the entire virtualization environment to become non-responsive or repeatedly fail during operation. The CVSS 3.1 scoring system rates this vulnerability at 5.5 with a high availability impact factor, indicating that successful exploitation can completely disable the virtualization platform and render it unusable for legitimate operations.
From an operational standpoint, this vulnerability creates substantial risk for organizations relying on Oracle VM VirtualBox for their virtualization needs. The low privilege requirements mean that attackers who have already established a foothold on the system can escalate their impact without requiring additional elevated permissions or complex attack vectors. This makes the vulnerability particularly attractive to threat actors who may be conducting reconnaissance or initial compromise activities within an organization's infrastructure. The ability to cause repeated crashes or complete system hangs can severely disrupt business operations, especially in environments where virtualized workloads are critical for service delivery.
The vulnerability aligns with CWE-476 which addresses NULL pointer dereference conditions that can lead to denial of service scenarios, and it maps to ATT&CK technique T1499.001 which covers network denial of service attacks through system resource exhaustion or corruption. Organizations should implement immediate mitigations including applying the latest security patches from Oracle, implementing network segmentation to limit access to virtualization hosts, and monitoring for unusual system behavior that might indicate exploitation attempts. Additionally, privileged access controls should be enforced to prevent unauthorized users from accessing the virtualization infrastructure where this vulnerability exists.
The availability impact of this vulnerability extends beyond simple service interruption to potentially causing cascading failures in virtualized environments where multiple dependent systems rely on the stability of the underlying virtualization platform. Organizations running Oracle VM VirtualBox 7.2.12 should prioritize patch management activities and consider implementing additional monitoring mechanisms to detect early signs of exploitation attempts that could lead to complete system compromise and operational disruption.