CVE-2026-87283 in VirtualBox
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 6.0 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the core component of Oracle VM VirtualBox, specifically affecting version 7.2.16 and potentially other supported releases depending on the specific code path exploited. This flaw represents a significant availability risk that allows for complete denial of service conditions against the virtualization platform. The technical nature of this defect involves an easily exploitable condition triggered by high-privileged attackers who have established logon access to the underlying infrastructure where VirtualBox is executing. Unlike vulnerabilities that compromise confidentiality or integrity, this issue primarily targets the operational stability and availability of the host system running the hypervisor software.
From a technical perspective, the vulnerability enables an attacker with local administrative privileges on the guest operating system or potentially through specific interactions within the virtualized environment to trigger a hang or a frequently repeatable crash of the Oracle VM VirtualBox application itself. The ease of exploitation suggests that the flaw does not require complex preconditions beyond standard authentication and access rights associated with high-privileged users. This characteristic makes it particularly dangerous in environments where multiple tenants share infrastructure, as an attacker gaining control over one virtual machine could potentially destabilize the host or other co-resident workloads if isolation boundaries are breached or if the vulnerability allows for scope expansion beyond the immediate guest environment.
The operational impact of this vulnerability is severe due to its direct effect on service availability. A successful exploit results in a complete denial of service, meaning that Oracle VM VirtualBox becomes unresponsive and requires manual intervention such as a hard reset or process termination to restore functionality. This disruption can lead to significant downtime for critical applications running within the virtualized environment. Furthermore, because attacks may significantly impact additional products due to scope changes, the instability caused by this vulnerability could cascade into broader infrastructure failures if VirtualBox is integrated with other management tools or dependent services that rely on its continuous operation. The CVSS 3.1 base score of 6.0 reflects a medium severity rating driven primarily by high availability impacts despite requiring local privileges and low attack complexity.
In terms of industry standard classifications, this vulnerability aligns with CWE-400: Uncontrolled Resource Consumption or CWE-835: Loop with Unreachable Exit Condition depending on the specific mechanism causing the hang or crash. It also maps to MITRE ATT&CK techniques related to Denial of Service, specifically T1499: Endpoint Denial of Service or potentially T1529: System Shutdown or Reboot if the exploit leads to a forced restart scenario. The vector string CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H indicates that while the attack requires local access and high privileges, it has no user interaction requirement and results in complete availability loss with scope change, confirming the potential for broader infrastructure impact beyond the immediate VirtualBox process.
Mitigation strategies should focus on strict privilege management and environmental hardening to reduce the risk surface. Administrators must ensure that only trusted users are granted high-privileged access to systems running Oracle VM VirtualBox. Implementing least-privilege principles is critical, as reducing the number of accounts with elevated permissions directly limits the pool of potential attackers who can exploit this flaw. Additionally, keeping Oracle VM VirtualBox updated to versions where this core vulnerability has been patched by Oracle is essential for long-term remediation. In interim scenarios, network segmentation and monitoring solutions that detect abnormal process behavior or resource consumption spikes associated with VirtualBox processes can help identify attempted exploits early. Regular audits of user privileges and continuous integration of security patches remain the most effective defenses against such availability-focused vulnerabilities in virtualization infrastructure.