CVE-2025-62589CWE-267

CVE-2025-62589

High · published October 22, 2025

CVSS v3.1
8.2
EPSS
0%
Percentile
10.6
In the wild
Unconfirmed
What it is

⚡ A high-privilege attacker with local access can compromise Oracle VM VirtualBox, leading to a potential takeover of the entire virtual environment! 🔥 Think of Oracle VM VirtualBox as a secure hotel hosting multiple guests (virtual machines). If someone with a key to the lobby can sneak into the admin office, they could tamper with guest reservations and even access sensitive information. That's what's happening here! If exploited, this vulnerability could allow attackers to seize control of Oracle VM VirtualBox, jeopardizing the confidentiality and integrity of all hosted virtual machines. Imagine a scenario where someone rearranges the entire guest list and changes room assignments - chaos ensues!

Put simply

Think of Oracle VM VirtualBox as a secure hotel hosting multiple guests (virtual machines). If someone with a key to the lobby can sneak into the admin office, they could tamper with guest reservations and even access sensitive information. That's what's happening here! This vulnerability exists in Oracle VM VirtualBox versions 7.1.12 and 7.2.2 and allows an attacker with high privileges to manipulate the virtualization environment, potentially impacting additional connected products due to the scope change.

What to do

If exploited, this vulnerability could allow attackers to seize control of Oracle VM VirtualBox, jeopardizing the confidentiality and integrity of all hosted virtual machines. Imagine a scenario where someone rearranges the entire guest list and changes room assignments - chaos ensues! To protect your systems, patch Oracle VM VirtualBox to version 7.2.3 or later immediately. Regularly audit your infrastructure to ensure only authorized users have access, and consider implementing additional monitoring solutions to detect unusual activities. You've got this! By taking these steps, you can fortify your environment and keep those pesky attackers at bay! 🛡️

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00209 · 10.6th percentile
Weakness
CWE-267 · Privilege Defined With Unsafe Actions
Published
2025-10-22T00:20Z
Affected products (2)
ProductVersionsFixed in
oracle/vm_virtualboxall versions—
oracle/vm_virtualboxall versions—
References (1)
EPSS history
Timeline
  • 21 OCT 20:03Z
    Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
    cvelistv5