ZDI-26-641: Oracle VirtualBox VirtioSCSI Out-Of-Bounds Read Information Disclosure Vulnerability

CVE-2026-71114 is an information disclosure vulnerability in the Core component of Oracle VM VirtualBox; the ZDI advisory characterizes it as an out-of-bounds read in the VirtioSCSI component (Oracle classifies it under CWE-284, improper access control). It is triggered by an attacker who already has a high-privileged logon on the infrastructure where VirtualBox runs, requires no user interaction, and is rated easily exploitable. Successful attacks yield unauthorized access to critical data, potentially all data accessible to VirtualBox, and the scope change means the impact can extend to additional products beyond VirtualBox itself, though integrity and availability are unaffected. Any deployment running the affected 7.2.14 release of the 7.2 branch is exposed, including desktop hosts and test lab servers where users or automation hold privileged local accounts. Exploitation has not been observed: there is no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at about 0.2%.

Do: Upgrade VirtualBox 7.2.14 installations to the patched release published in Oracle's Critical Patch Update (check the Oracle Virtualization CPU advisory for the exact fixed 7.2.x version). Until patched, restrict high-privileged local logon access on VirtualBox hosts to trusted administrators and review what host resources VirtualBox can access. Note the scope change: treat exposed credentials or sensitive data readable by VirtualBox as potentially exposed to other products on the same infrastructure.