CVE-2026-46768
Description
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA device). The supported version that is affected is 7.2.8. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 6.0 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H).
Summary dbcve.org
Vulnerability in Oracle VM VirtualBox's VMSVGA (virtual SVGA graphics adapter) device emulation. A high-privileged attacker with local access to the infrastructure can cause a denial of service (VM hang or crash) by exploiting the VMSVGA component. The attack requires no user interaction and has a changed scope, potentially impacting additional products beyond VirtualBox itself.
Mitigation
Apply the Oracle patch for VirtualBox 7.2.8 when available, or disable the VMSVGA graphics device and use a different virtual graphics adapter (such as VBoxVGA or VBoxSVGA) for affected VMs as a temporary workaround.