CVE-2026-71113 in VirtualBox
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via RDP to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the core component of Oracle VM VirtualBox, specifically affecting version 7.2.14 and potentially other supported releases depending on patch availability. This flaw represents a critical security deficiency that allows for remote exploitation without requiring any form of authentication from the attacker. The attack vector is facilitated through the Remote Desktop Protocol (RDP), which serves as the primary interface for managing virtual machines remotely. Because the vulnerability permits unauthenticated access, an adversary with network connectivity to the host running VirtualBox can initiate a malicious sequence that directly targets the stability and availability of the hypervisor software itself.
From a technical perspective, the core issue manifests as a condition leading to system instability rather than data compromise or privilege escalation. The exploit triggers a state within the VirtualBox engine where the application becomes unresponsive or enters a loop that necessitates a restart. This behavior classifies the vulnerability primarily as an availability impact, aligning with Common Weakness Enumeration (CWE) categories such as CWE-400: Uncontrolled Resource Consumption or CWE-835: Loop with Unreachable Exit Condition depending on the specific internal mechanism triggering the hang. The lack of input validation or proper state management in handling RDP packets allows an external actor to force the application into a fatal error state, resulting in a complete denial of service for any virtual machines hosted by that instance and disrupting administrative access via the remote desktop interface.
The operational impact of this vulnerability is significant due to its ease of exploitation and lack of authentication requirements. An attacker can achieve a complete denial of service simply by sending crafted network packets over RDP, causing Oracle VM VirtualBox to hang or crash repeatedly. This disruption prevents legitimate users from accessing their virtual machines, halting business operations that rely on these environments for development, testing, or production workloads. Since the vulnerability affects the core component, it impacts all guests running under the compromised host instance simultaneously during the outage window. The CVSS 3.1 base score of 7.5 reflects this high severity level driven by network accessibility and low complexity requirements, emphasizing that no user interaction is needed to trigger the crash.
In terms of threat modeling, this vulnerability aligns with MITRE ATT&CK techniques related to Denial of Service against cloud or virtualization infrastructure. Attackers may leverage such flaws in automated campaigns to disrupt services without needing persistent access credentials, making it a viable tool for disruptive attacks rather than espionage or data theft. The absence of authentication requirements further lowers the barrier to entry, allowing even less sophisticated actors to execute successful denial-of-service attacks against organizations relying on Oracle VM VirtualBox for their virtualization needs.
Mitigation strategies must prioritize immediate patching and network segmentation until updates are applied. Organizations should apply the latest security patches released by Oracle that address this specific core component flaw in version 7.2.14 or earlier affected versions. If patching is not immediately feasible, restricting RDP access to trusted IP addresses via firewall rules can significantly reduce the attack surface. Additionally, implementing network-level authentication requirements for RDP connections and monitoring for unusual spikes in connection attempts may help detect exploitation attempts before they result in service disruption. Regular audits of virtualization infrastructure configurations should also be conducted to ensure that remote management interfaces are not exposed unnecessarily to untrusted networks.