ZDI-26-640: Oracle VirtualBox VirtioSCSI Uninitialized Memory Information Disclosure Vulnerability
ZDI detailed an uninitialized memory flaw in Oracle VirtualBox's VirtioSCSI (CVE-2026-71132) allowing local attackers to disclose sensitive information.
Zero Day Initiative published ZDI-26-640, a CVSS 5.3 information disclosure vulnerability in the VirtioSCSI component of Oracle VirtualBox. An attacker must first run high-privileged code on the guest system before the uninitialized memory issue can be used to disclose sensitive information. The flaw is tracked as CVE-2026-71132. The advisory reports no exploitation activity.
- Uninitialized memory disclosure in VirtualBox VirtioSCSI, tracked as CVE-2026-71132
- CVSS 5.3; requires high-privileged code execution on the guest first
- Published as ZDI-26-640 by the Zero Day Initiative
- No in-the-wild exploitation reported
- CVEs
- CVE-2026-71132
- Vendors
- OracleZero Day Initiative
- Products
- Oracle VirtualBox
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-71132 | Information Disclosure in Oracle VM VirtualBox 7.2.14 (VirtioSCSI) | 5.3 | <1% |
From the original article
This vulnerability allows local attackers to disclose sensitive information on affected installations of Oracle VirtualBox. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.