CVE-2026-71128 in VM VirtualBox
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.14. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 6.0 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the core component of Oracle VM VirtualBox, specifically affecting version 7.2.14 and potentially other supported releases depending on the specific code path exploited. This flaw represents a significant availability risk that stems from an easily exploitable condition requiring high-privileged access to the host infrastructure where the virtualization software operates. The nature of this vulnerability allows an attacker who has already achieved logon privileges on the underlying operating system to trigger conditions that lead to complete denial of service against the VirtualBox application itself. This is not merely a minor instability issue but rather a mechanism for causing frequent, repeatable crashes or hangs within the virtualization environment, effectively rendering it unusable until restarted by an administrator.
From a technical perspective, this vulnerability aligns with CWE-400, which describes uncontrolled resource consumption leading to denial of service conditions. The attack vector is classified as local with low complexity and requires high privileges, indicating that the threat actor must already have substantial access rights on the host machine. This suggests the flaw likely involves improper handling of resources or state management within the VirtualBox core when processing specific inputs from a privileged user context. Because the vulnerability impacts the availability component significantly while leaving confidentiality and integrity intact in its immediate scope, it is categorized as an availability-focused defect. However, the operational impact extends beyond simple application downtime due to the potential for scope change, where the instability of the hypervisor could disrupt other products or services running on the same infrastructure.
The ATT&CK framework categorizes this type of behavior under techniques related to resource exhaustion and service disruption. Specifically, it relates to T1499 Endpoint Denial of Service variants that involve crashing applications through local exploitation rather than network-based attacks. The requirement for high privilege means that traditional remote attack vectors are not applicable here; instead, the risk is elevated in environments where multiple users share host systems or where administrative accounts may be compromised via other lateral movement techniques. Once an attacker gains these privileges, they can systematically crash VirtualBox instances to disrupt virtualized workloads, potentially causing data loss if unsaved states are lost during a forced restart of the hypervisor services.
Mitigation strategies must focus on strict access control and monitoring within the host environment. Since the vulnerability requires high-privileged logon, enforcing least privilege principles is paramount. Administrators should ensure that only essential personnel have administrative rights over systems running Oracle VM VirtualBox. Additionally, keeping the software updated to versions where this core flaw has been patched by Oracle is critical. In environments where patching cannot occur immediately, implementing strict monitoring for abnormal process termination or high resource usage spikes associated with VBox processes can help detect exploitation attempts early. Furthermore, isolating virtualization hosts from general-purpose workstations reduces the attack surface available to potential attackers seeking local privilege escalation opportunities that could lead to this specific denial of service condition.