CVE-2026-71135 in VirtualBox
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.14. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 6.0 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the core component of Oracle VM VirtualBox, specifically affecting version 7.2.14 and potentially other supported releases depending on the specific code path involved. This flaw represents a significant stability issue that can be triggered by an attacker with high privileges who has established logon access to the host infrastructure where the virtualization software is executing. The nature of this vulnerability allows for easy exploitation, meaning that once the necessary authentication and privilege levels are achieved, the attack vector requires little complexity or additional user interaction to trigger the malicious condition. This ease of exploitation lowers the barrier for entry compared to more complex memory corruption flaws, making it a viable target for insiders or attackers who have already gained substantial access to the system environment.
From a technical perspective, the vulnerability manifests as an instability in the VirtualBox core logic that leads to complete denial of service conditions. Successful exploitation results in either a hang or a frequently repeatable crash of the Oracle VM VirtualBox application itself. This is not merely a transient error but a persistent failure state that disrupts the availability of the virtualization platform. The impact extends beyond the immediate process, as indicated by the scope change noted in the vulnerability description. Because VirtualBox often manages critical workloads or serves as an infrastructure component for development and testing environments, its compromise can significantly impact additional products running within those virtual machines or relying on the host system's resources. This cascading effect amplifies the severity of the incident beyond a simple application crash.
The operational impact is primarily categorized under availability impacts, aligning with a CVSS 3.1 Base Score of 6.0 which reflects medium severity due to the high impact on availability despite requiring privileged access and local attack vectors. The specific vector components indicate that while the attack requires low complexity and no user interaction, it demands high privileges and has a changed scope, meaning the vulnerability affects resources beyond its own security boundary. This characteristic is critical for organizations relying on VirtualBox for continuous operations or as part of a larger virtualized ecosystem. A crash in this component can lead to data loss if unsaved workloads are terminated abruptly, downtime for dependent services, and potential instability in the host operating system depending on how the hypervisor handles the fault condition.
In terms of classification standards, this vulnerability aligns with CWE-400 Uncontrolled Resource Consumption or potentially CWE-835 Loop with Unreachable Exit Condition if the hang is caused by infinite loops within the core logic. The attack pattern corresponds to ATT&CK technique T1499 Endpoint Denial of Service, specifically under sub-techniques involving resource exhaustion or application crashes. Although the attacker requires high privileges, which typically places it in a lower risk category for remote exploitation, the local nature combined with the potential for scope change makes it a serious concern for internal threat models and insider threats who have already bypassed initial access controls.
Mitigation strategies should focus on immediate patching to update Oracle VM VirtualBox to a version where this core flaw has been resolved by the vendor. Organizations must ensure that their virtualization infrastructure is kept up-to-date with the latest security patches released by Oracle. Additionally, since exploitation requires high privileged logon access, enforcing strict least-privilege principles and robust authentication mechanisms on systems running VirtualBox can reduce the likelihood of an attacker achieving the necessary level of access to trigger this vulnerability. Monitoring for unusual process termination events or repeated crashes in the VirtualBox service may also serve as an early detection mechanism for attempted exploitation attempts within the environment.