CVE-2025-62641CWE-267

CVE-2025-62641

High · published October 22, 2025

CVSS v3.1
8.2
EPSS
0%
Percentile
10.0
In the wild
Unconfirmed
What it is

⚡ A single privileged access could hand over control of Oracle VM VirtualBox to attackers! This vulnerability is like giving someone the master blueprint to your fortress without checking their credentials. 🔥 Think of Oracle VM VirtualBox as a well-guarded library. If an attacker gains access with a librarian’s key, they can not only check out rare books but also rearrange the entire collection to suit their needs, potentially causing chaos throughout the library's operations. If exploited, this vulnerability could allow an attacker to take complete control of Oracle VM VirtualBox, leading to compromised security across potentially multiple products. This could result in unauthorized access to sensitive data, system manipulation, and even service disruptions. The consequences could be absolutely devastating!

Put simply

Think of Oracle VM VirtualBox as a well-guarded library. If an attacker gains access with a librarian’s key, they can not only check out rare books but also rearrange the entire collection to suit their needs, potentially causing chaos throughout the library's operations. This vulnerability resides in Oracle VM VirtualBox, allowing attackers with high privileges who are logged into the infrastructure to compromise the system. It primarily affects versions 7.1.12 and 7.2.2, creating a significant risk to confidentiality, integrity, and availability.

What to do

If exploited, this vulnerability could allow an attacker to take complete control of Oracle VM VirtualBox, leading to compromised security across potentially multiple products. This could result in unauthorized access to sensitive data, system manipulation, and even service disruptions. The consequences could be absolutely devastating! Immediately update Oracle VM VirtualBox to the latest version to avoid potential exploitation. Implement strict access controls to ensure that only trusted users have privileges to this environment. It’s also wise to regularly audit your configurations and permissions to maintain heightened security. You've got this! Stay proactive, follow these steps, and you'll keep your systems secure! 🛡️

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00205 · 10.0th percentile
Weakness
CWE-267 · Privilege Defined With Unsafe Actions
Published
2025-10-22T00:20Z
Affected products (2)
ProductVersionsFixed in
oracle/vm_virtualboxall versions—
oracle/vm_virtualboxall versions—
References (1)
EPSS history
Timeline
  • 21 OCT 20:03Z
    Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
    cvelistv5