CVE-2026-87267 in VM VirtualBox
Summary
by MITRE
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Difficult to exploit vulnerability allows low privileged attacker with network access via RDP to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the core component of Oracle VM VirtualBox, specifically affecting version 7.2.16 and potentially other supported releases in that lineage. This flaw represents a significant availability risk for environments relying on this virtualization platform to host guest operating systems or run isolated workloads. The nature of the defect is characterized by its difficulty to exploit, which implies that while an attack vector exists, it requires specific conditions or precise triggering mechanisms rather than being trivially exploitable through simple automated scripts. However, the existence of a network-accessible entry point via Remote Desktop Protocol (RDP) significantly lowers the barrier for potential adversaries who have already gained low-privileged access to the host system or can interact with the RDP service exposed by the VirtualBox instance.
From a technical perspective, the vulnerability allows an attacker with low privileges and network connectivity through RDP to induce a complete denial of service condition. This is achieved by causing the Oracle VM VirtualBox application to hang or crash repeatedly. Unlike vulnerabilities that lead to privilege escalation or data exfiltration, this flaw targets the availability aspect of the CIA triad exclusively. The operational impact is severe for users who depend on continuous uptime from their virtualized environments. A complete denial of service means that any guest machines running within VirtualBox are abruptly terminated and cannot be restarted without manual intervention by a system administrator with higher privileges or physical access to the host machine. This disruption can lead to significant downtime, loss of productivity, and potential data corruption if processes were not properly shut down before the crash occurred.
The classification of this vulnerability aligns with CWE-400, which covers Uncontrolled Resource Consumption leading to Denial of Service. The specific mechanism likely involves a flaw in how VirtualBox handles certain RDP-related requests or state transitions within its core architecture, causing it to enter an unrecoverable loop or consume resources beyond acceptable limits until the application fails. In terms of threat modeling and adversary behavior, this vulnerability maps to MITRE ATT&CK technique T1499, Endpoint Denial of Service. Attackers may leverage such flaws as part of a broader campaign to disrupt operations, distract security teams, or create chaos within an infrastructure before attempting more damaging actions like data destruction or lateral movement once defenses are compromised by the outage.
Mitigation strategies for this vulnerability primarily involve applying the latest patches provided by Oracle Virtualization as soon as they become available for version 7.2.16 and subsequent releases. Since the attack vector requires network access via RDP, organizations should also review their remote desktop configurations to ensure that only authorized users have access to these services. Implementing strict firewall rules to restrict RDP traffic to trusted IP ranges can reduce the exposure surface. Additionally, enabling robust logging and monitoring for VirtualBox processes allows administrators to detect unusual activity patterns or repeated crashes early, facilitating faster incident response. Regular updates of virtualization software are critical not only for feature enhancements but also for maintaining a secure posture against evolving threats that target core infrastructure components.