Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilitymedium

Zero Day Initiative publishes six Oracle VirtualBox advisories (ZDI-26-639 through ZDI-26-644) covering VMSVGA, VirtioSCSI, and IDisplay local guest flaws

1 source · 6 articlesFirst reported Updated ()3 · 1 read
What's new

Initial merged summary — no previous story summary existed. This entry consolidates the six ZDI advisories published 2026-09-09 into a single story; no disagreements between the source reports were found.

Merged summary · glm-5.3-flash · rewritten as coverage arrivesSummaries by Vani AI

On 2026-09-09, ZDI disclosed six Oracle VirtualBox vulnerabilities — CVE-2026-71116, CVE-2026-60155, CVE-2026-60159, CVE-2026-60162, CVE-2026-71114, and CVE-2026-71132 — affecting the VMSVGA, IDisplay, and VirtioSCSI components. Three enable local privilege…

The Zero Day Initiative published six advisories for Oracle VirtualBox on 2026-09-09, numbered ZDI-26-639 through ZDI-26-644, all describing local guest-system flaws that require an attacker to first obtain the ability to execute high-privileged code on the guest. In the VMSVGA component, ZDI-26-639 (CVE-2026-71116) is a heap-based buffer overflow enabling local privilege escalation rated CVSS 7.5; ZDI-26-644 (CVE-2026-60155) is a race condition enabling local privilege escalation rated CVSS 7.5; and ZDI-26-643 (CVE-2026-60162) is an out-of-bounds read enabling information disclosure rated CVSS 6.1. In the VirtioSCSI component, ZDI-26-641 (CVE-2026-71114) is an out-of-bounds read enabling information disclosure rated CVSS 6.1, and ZDI-26-640 (CVE-2026-71132) is an uninitialized-memory information disclosure issue rated CVSS 5.3. In the IDisplay component, ZDI-26-642 (CVE-2026-60159) is an out-of-bounds read enabling local privilege escalation rated CVSS 7.5. None of the advisories report exploitation in the wild. The reports do not state affected VirtualBox versions or fixed releases.

Key facts
  • Six ZDI advisories published 2026-09-09, numbered ZDI-26-639 through ZDI-26-644, all affecting Oracle VirtualBox.
  • ZDI-26-639: heap-based buffer overflow in VMSVGA, CVE-2026-71116, local privilege escalation, CVSS 7.5.
  • ZDI-26-644: race condition in VMSVGA, CVE-2026-60155, local privilege escalation, CVSS 7.5.
  • ZDI-26-642: out-of-bounds read in IDisplay, CVE-2026-60159, local privilege escalation, CVSS 7.5.
  • ZDI-26-643: out-of-bounds read in VMSVGA, CVE-2026-60162, information disclosure, CVSS 6.1.
  • ZDI-26-641: out-of-bounds read in VirtioSCSI, CVE-2026-71114, information disclosure, CVSS 6.1.
  • ZDI-26-640: uninitialized memory issue in VirtioSCSI, CVE-2026-71132, information disclosure, CVSS 5.3.
  • All six flaws are local and require prior execution of high-privileged code on the guest system.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
CVEs
CVE-2026-71116CVE-2026-60155CVE-2026-71114CVE-2026-60159CVE-2026-60162CVE-2026-71132
Vendors
OracleZero Day Initiative
Products
Oracle VirtualBoxVirtualBox
Organizations
Zero Day InitiativeOracle

Coverage

oldest first · one row per article · UTC
  1. · Sep 9, 2026 ZDI Published AdvisoriesFirst report

    ZDI-26-641: Oracle VirtualBox VirtioSCSI Out-Of-Bounds Read Information Disclosure Vulnerability

    ZDI disclosed CVE-2026-71114, an out-of-bounds read in Oracle VirtualBox VirtioSCSI letting privileged local guest attackers disclose sensitive information.

  2. · Sep 9, 2026 ZDI Published Advisories

    ZDI-26-643: Oracle VirtualBox VMSVGA Out-Of-Bounds Read Information Disclosure Vulnerability

    ZDI publishes ZDI-26-643 for CVE-2026-60162, an out-of-bounds read information disclosure flaw in Oracle VirtualBox VMSVGA, rated CVSS 6.1.

  3. · Sep 9, 2026 ZDI Published Advisories

    ZDI-26-640: Oracle VirtualBox VirtioSCSI Uninitialized Memory Information Disclosure Vulnerability

    ZDI detailed an uninitialized memory flaw in Oracle VirtualBox's VirtioSCSI (CVE-2026-71132) allowing local attackers to disclose sensitive information.

  4. · Sep 9, 2026 ZDI Published Advisories

    ZDI-26-639: Oracle VirtualBox VMSVGA Heap-based Buffer Overflow Local Privilege Escalation Vulnerability

    ZDI disclosed a heap-based buffer overflow in Oracle VirtualBox's VMSVGA component (CVE-2026-71116) enabling local privilege escalation.

  5. · Sep 9, 2026 ZDI Published Advisories

    ZDI-26-642: Oracle VirtualBox IDisplay Out-Of-Bounds Read Local Privilege Escalation Vulnerability

    ZDI publishes ZDI-26-642 for CVE-2026-60159, an out-of-bounds read local privilege escalation in Oracle VirtualBox IDisplay, rated CVSS 7.5.

  6. · Sep 9, 2026 ZDI Published Advisories

    ZDI-26-644: Oracle VirtualBox VMSVGA Race Condition Local Privilege Escalation Vulnerability

    ZDI publishes ZDI-26-644 for CVE-2026-60155, a race condition local privilege escalation in Oracle VirtualBox VMSVGA, rated CVSS 7.5.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-60155
+2 related CVEs
CVE-2026-60159CVE-2026-60162
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component
7.5
group max
<1%
CVE-2026-71116
+2 related CVEs
CVE-2026-71114CVE-2026-71132
Heap-Based Buffer Overflow in Oracle VM VirtualBox VMSVGA Enables Local Privilege Escalation
7.5
group max
<1%