CVE-2026-46873: Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA device)

Synopsis

This is a privilege-escalation and full-compromise vulnerability in the VMSVGA device component of Oracle VM VirtualBox 7.2.8. An attacker who already holds a high-privileged account and local access to the host where VirtualBox runs can exploit difficult-to-trigger conditions in the virtual graphics device to fully take over the VirtualBox process, with a scope change meaning impact can spill beyond the VM boundary into the host or sibling workloads. Successful exploitation grants the attacker complete read, write, and availability control over the affected instance. HarborGuard is tracking this advisory for patch availability and will make a patched-image rebuild available the moment Oracle publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or privileged process on the host where VirtualBox executes; no network path to the service is required.

• AuthenticationRequired

  A high-privileged (admin-level) account on the host infrastructure is required before the vulnerability can be reached.

• Victim interactionNot required

  No user action or social-engineering step is needed; the attacker operates independently once host access is established.

• Attack complexityDetail

  Attack complexity is HIGH, meaning the exploit depends on specific environmental conditions or race conditions that make reliable triggering difficult and non-trivial to reproduce.

Blast Radius

• Reads all data accessible to the VirtualBox process, including VM memory contents, guest state, and any secrets loaded into the hypervisor context.
• Writes to or modifies VM configuration, guest memory, and persisted disk state, enabling tampering with guest workloads.
• Crashes or destabilizes the VirtualBox process, taking down any running guest VMs and disrupting dependent services.
• Because the CVSS scope is changed, impact can extend beyond the targeted VM to the host OS or other guests sharing the same hypervisor, broadening the footprint of a successful attack.