CVE-2026-87301 in VM VirtualBox
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.4 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the core component of Oracle VM VirtualBox, specifically affecting version 7.2.16 and potentially earlier supported releases. This flaw represents a significant security risk due to its potential for exploitation by low-privileged attackers who have established logon access to the host infrastructure where the virtualization software is executing. The presence of this vulnerability indicates a fundamental weakness in how VirtualBox handles certain inputs or state transitions within its core architecture, allowing an attacker with minimal privileges to escalate their influence over the system beyond intended boundaries. This scenario highlights the critical importance of securing not just the guest operating systems but also the host environment and the virtualization layer itself, as compromises at this level can cascade into broader infrastructure failures.
The technical nature of this flaw enables unauthorized access to critical data stored within or accessible by the VirtualBox instance. Furthermore, it grants attackers the ability to cause a hang or frequently repeatable crash of the Oracle VM VirtualBox application, resulting in a complete denial of service condition. The impact is characterized as high for both confidentiality and availability, reflecting the severity of potential data exfiltration and operational disruption. Because attacks may significantly impact additional products beyond just VirtualBox itself, this represents a scope change vulnerability where the breach of one component leads to compromise of interconnected systems or services relying on stable virtualization resources. This amplifies the risk profile considerably, as it is no longer an isolated issue but a potential vector for wider infrastructure instability and data loss across multiple dependent applications.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation if the root cause involves malformed or unexpected input triggering the flaw, or potentially CWE-787 Out-of-bounds Write if memory corruption is involved in causing crashes and unauthorized access. In terms of adversary tactics, exploitation would likely fall under MITRE ATT&CK techniques such as T1546 Event Triggered Execution for maintaining persistence or achieving privilege escalation after initial compromise, and T1499 Endpoint Denial of Service for the availability impact. The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H confirms that while network access is not required (local attack), the low complexity and lack of user interaction make it highly exploitable by any authenticated local user, which is a common threat model in multi-tenant or shared hosting environments.
Mitigation strategies must prioritize immediate patching to version 7.2.16 or later if available, as Oracle typically addresses such core vulnerabilities in subsequent point releases. Organizations should enforce strict least privilege principles on host systems running VirtualBox, ensuring that only trusted administrators have local logon access rather than general users who might be targeted by this low-privilege exploit. Additionally, implementing robust input validation and memory safety checks within custom extensions or third-party plugins interacting with the VirtualBox core can reduce the attack surface. Network segmentation should also be reviewed to limit lateral movement in case a host is compromised, ensuring that virtualized workloads are isolated from critical production data stores where possible. Regular auditing of user privileges on hypervisor hosts and monitoring for unusual process termination patterns indicative of denial-of-service attempts are essential operational security measures until the patch is applied.