30
35
30
ZDI-26-639: Oracle VirtualBox VMSVGA Heap-based Buffer Overflow Local Privilege Escalation Vulnerability
ZDI disclosed a heap-based buffer overflow in Oracle VirtualBox's VMSVGA component (CVE-2026-71116) enabling local privilege escalation.
Zero Day Initiative published ZDI-26-639, a CVSS 7.5 heap-based buffer overflow in the VMSVGA component of Oracle VirtualBox. Local attackers who already execute high-privileged code on the guest system can leverage the flaw to escalate privileges on affected installations. The vulnerability is tracked as CVE-2026-71116. No exploitation is reported.
27
30
30
30
30
35
30
30
30
30
30
30
UBoatRAT Navigates East Asia
Unit 42 discovers UBoatRAT, a new custom RAT targeting South Korean and video-game industry personnel, delivered via Google Drive with GitHub-based C2 and BITS persistence.
Unit 42 identified UBoatRAT, a new custom remote access trojan first found in May 2017, whose initial version used a public Hong Kong blog service and a compromised Japanese web server for command and control. The latest variants target personnel or organizations related to South Korea or the video games industry, are delivered through Google Drive, and masquerade as Microsoft Word, Excel, or folder icons. The RAT checks for virtualization software and domain join, retrieves its C2 address from a Base64-encoded string in a GitHub-hosted file, uses a custom XOR-encrypted C2 protocol, and maintains persistence via Windows Background Intelligent Transfer Service (BITS) jobs that survive reboots.
44
30
30
30
30
30
30
30
35
30
30
45
30
30
30
30
30
30
30
30
35
30
30
30
30