Search: “Oracle VirtualBox”

ZDI-26-639: Oracle VirtualBox VMSVGA Heap-based Buffer Overflow Local Privilege Escalation Vulnerability

ZDI disclosed a heap-based buffer overflow in Oracle VirtualBox's VMSVGA component (CVE-2026-71116) enabling local privilege escalation.

Zero Day Initiative published ZDI-26-639, a CVSS 7.5 heap-based buffer overflow in the VMSVGA component of Oracle VirtualBox. Local attackers who already execute high-privileged code on the guest system can leverage the flaw to escalate privileges on affected installations. The vulnerability is tracked as CVE-2026-71116. No exploitation is reported.

ZDI Published Advisories·Sep 9, 05:00 UTC · 7d agoVulnerability 6 sourcesCVE-2026-71116

ZDI-26-644: Oracle VirtualBox VMSVGA Race Condition Local Privilege Escalation Vulnerability

ZDI publishes ZDI-26-644 for CVE-2026-60155, a race condition local privilege escalation in Oracle VirtualBox VMSVGA, rated CVSS 7.5.

Zero Day Initiative published advisory ZDI-26-644 describing a race condition in Oracle VirtualBox's VMSVGA component. Local attackers who already execute high-privileged code on the guest system can escalate privileges on affected installations. ZDI rated the issue CVSS 7.5 and assigned CVE-2026-60155.

ZDI Published Advisories·Sep 9, 05:00 UTC · 7d agoAdvisory 6 sourcesCVE-2026-60155

ZDI-26-641: Oracle VirtualBox VirtioSCSI Out-Of-Bounds Read Information Disclosure Vulnerability

ZDI disclosed CVE-2026-71114, an out-of-bounds read in Oracle VirtualBox VirtioSCSI letting privileged local guest attackers disclose sensitive information.

The Zero Day Initiative published advisory ZDI-26-641 for an out-of-bounds read vulnerability in Oracle VirtualBox's VirtioSCSI component, assigned CVE-2026-71114 with a CVSS score of 6.1. The flaw allows local attackers to disclose sensitive information on affected installations. Exploitation requires an attacker to first obtain the ability to execute high-privileged code on the target guest system.

ZDI Published Advisories·Sep 9, 05:00 UTC · 7d agoVulnerability 6 sourcesCVE-2026-71114

ZDI-26-642: Oracle VirtualBox IDisplay Out-Of-Bounds Read Local Privilege Escalation Vulnerability

ZDI publishes ZDI-26-642 for CVE-2026-60159, an out-of-bounds read local privilege escalation in Oracle VirtualBox IDisplay, rated CVSS 7.5.

Zero Day Initiative published advisory ZDI-26-642 describing an out-of-bounds read in Oracle VirtualBox's IDisplay component that enables local privilege escalation. Attackers must first obtain the ability to execute high-privileged code on the target guest system. ZDI rated the issue CVSS 7.5 and assigned CVE-2026-60159.

ZDI Published Advisories·Sep 9, 05:00 UTC · 7d agoAdvisory 6 sourcesCVE-2026-60159

Pwn2Own 2020 - Participants hacked Adobe Reader, Oracle VirtualBox, and Windows

Security Affairs·Mar 20, 10:08 UTC · Mar 20, 2020Vulnerability

Pwn2Own 2020 Day1 - researchers earned $180K for hacking Windows, Ubuntu, and macOS

Security Affairs·Mar 19, 10:31 UTC · Mar 19, 2020Vulnerability

To crypt, or to mine

Kaspersky Securelist·Jul 5, 10:00 UTC · Jul 5, 2018Malware1

Hackers awarded $267,000 at Pwn2Own 2018, was far less than in the past editions

Security Affairs·Mar 17, 13:36 UTC · Mar 17, 2018Vulnerability

How to Build a Custom Malware Analysis Sandbox

The Hacker News·Mar 25, 08:38 UTC · Mar 25, 2022Malware

Pwn2Own 2021 Day 1

Security Affairs·Apr 7, 15:07 UTC · Apr 7, 2021Vulnerability

Pwn2Own 2019 Day 3: Experts hacked Tesla 3 browser

Security Affairs·Mar 23, 12:37 UTC · Mar 23, 2019Vulnerability

VirtualBox 7.2.8 is out with Linux kernel 7.0 support and crash fixes

Help Net Security·Apr 21, 00:00 UTC · Apr 21, 2026Vulnerability

Fake Adobe and Zoom Updates Install ScreenConnect for Persistent Remote Access

The Hacker News·Aug 4, 13:18 UTC · Aug 4, 2026Malware1

Hackers Using MSIX App Packages to Infect Windows PCs with GHOSTPULSE Malware

The Hacker News·Oct 30, 06:58 UTC · Oct 30, 2023Malware

ZeroCleare: New Iranian Data Wiper Malware Targeting Energy Sector

The Hacker News·Dec 5, 09:07 UTC · Dec 5, 2019Malware

Latin American Javali trojan weaponizing Avira antivirus legitimate injector to implant malware

Security Affairs·Feb 17, 07:39 UTC · Feb 17, 2021Malware