CVE-2026-87311 in VM VirtualBox
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 5.6 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the core component of Oracle VM VirtualBox, specifically affecting version 7.2.16 and potentially other supported releases in that lineage. This flaw is classified as a denial-of-service condition rather than an arbitrary code execution or privilege escalation vector. The technical nature of the defect allows for a complete halt or frequent repetition of crashes within the virtualization environment when triggered by specific inputs or operational states. While the immediate impact is confined to the stability of the VirtualBox application itself, the broader security implications are significant due to the potential scope change mentioned in the advisory. In enterprise environments where Oracle VM VirtualBox serves as a foundational infrastructure component for development, testing, or production workloads, an instability in this core module can cascade into disruptions across dependent systems and services that rely on consistent virtual machine availability.
Exploitation of this vulnerability requires low-privileged access to the host operating system where Oracle VM VirtualBox is executing. This means that any user account with basic login capabilities on the underlying infrastructure possesses the necessary permissions to trigger the flaw, provided they can interact with the VirtualBox environment in a manner that invokes the defective code path. The attack complexity is rated as high, indicating that specific conditions or precise sequencing of events are required to successfully induce the crash state. This does not imply that the vulnerability is difficult to discover, but rather that reliable exploitation demands careful preparation and potentially multiple attempts due to the non-deterministic nature of some denial-of-service triggers. The absence of user interaction requirements further simplifies the attack vector for an insider threat or a compromised low-level account on the host machine.
The operational impact centers entirely on availability, as reflected in the CVSS 3.1 base score of 5.6 and the specific emphasis on high availability impacts with no compromise to confidentiality or integrity. A successful exploit results in unauthorized ability to cause a hang or frequently repeatable crash of Oracle VM VirtualBox. In practical terms, this translates to an inability for users to run virtual machines, loss of access to running guest operating systems, and potential data corruption if the crashes occur during active disk writes or network operations within the guests. For organizations relying on continuous uptime for their virtualized environments, such instability poses a direct threat to business continuity. The scope change noted in the vulnerability description suggests that while the code flaw is isolated to VirtualBox, the resulting downtime can affect adjacent products and services integrated with the hypervisor layer, thereby amplifying the risk beyond the immediate application boundary.
From a classification perspective, this vulnerability aligns with CWE-400, which covers uncontrolled resource consumption leading to denial of service conditions. It also maps to MITRE ATT&CK techniques related to Resource Hijacking or Service Availability impact, specifically within the context of virtualization infrastructure abuse. The low attack complexity and high privilege requirement for a complete system hang highlight the importance of strict access controls on host systems running hypervisor software. Even though the attacker requires only low privileges, the ability to disrupt core infrastructure services makes this a critical concern for security architects managing shared hosting environments or multi-tenant virtualization setups where one user’s actions can degrade service quality for others sharing the same physical resources.
Mitigation strategies must focus on both technical remediation and operational hardening. The primary defense is the immediate application of vendor-provided patches to update Oracle VM VirtualBox to a version that resolves this core component flaw. Organizations should prioritize patching in environments where low-privileged users have direct access to the host OS running VirtualBox, as these represent the highest risk surface area for exploitation. In addition to patching, implementing strict least-privilege principles is essential; administrators should review user accounts with local administrative or elevated privileges on hypervisor hosts and restrict them to only those individuals who absolutely require such access. Network segmentation can also help isolate virtualization management interfaces from general-purpose workstations that might be compromised by lower-level threats. Furthermore, deploying monitoring solutions that detect abnormal CPU spikes, memory exhaustion, or frequent process restarts associated with VirtualBox processes can provide early warning indicators of an attempted exploitation event, allowing for rapid incident response before widespread disruption occurs.