Loading story…
Oracle released VirtualBox 7.2.18, remediating 11 vulnerabilities and 19 additional defects. The most severe issue, CVE-2026-87273, carries a CVSS score of 8.6; five further flaws are rated 7.8, including four affecting Windows. The vulnerabilities could allow a guest virtual machine to access its host system, creating a material isolation risk for affected VirtualBox deployments.
The release also improves Linux Guest Additions compatibility and stability, Windows 11 on ARM support, VDI media handling, Linux-host 3D acceleration, and Shared Clipboard reliability. Organizations using VirtualBox should prioritize updating hosts and guest tooling to version 7.2.18, particularly where untrusted or externally supplied virtual machines are run.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Oracle released VirtualBox 7.2.18, fixing 11 vulnerabilities and 19 additional defects. The update addresses CVE-2026-87273 (CVSS 8.6) and five further flaws rated 7.8, with disclosed issues potentially allowing guest-to-host access.
Oracle released a Critical Patch Update addressing 673 vulnerabilities across its products, including fixes for MySQL, Java SE/GraalVM, and Solaris. The update includes two Java SE/GraalVM flaws remotely exploitable over HTTP, including a GraalVM vulnerability rated CVSS 8.1.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed two **Oracle VirtualBox** vulnerabilities in the **VirtualBox Video Acceleration (VBVA)** component that could let an attacker escape from a guest VM and execute code in the host VirtualBox process. The flaws, tracked as `CVE-2020-2682` and `CVE-2020-2758`, affected the HGSMI-exposed graphics path used by guest systems, making the vulnerable functionality reachable from inside a virtual machine when video acceleration features were enabled. `CVE-2020-2682` was an out-of-bounds access caused by using a guest-controlled surface handle as an index without effective bounds enforcement in release builds, while `CVE-2020-2758` was a use-after-free tied to stale VGA surface pointers during guest-triggerable display resize operations. In both cases, crafted VBVA commands could corrupt memory in the host-side VirtualBox process and potentially achieve privilege escalation or full VM escape. Oracle addressed the issues in its **January 2020** and **April 2020 Critical Patch Update** advisories, respectively.
Jun 29, 2026
Oracle patched two VirtualBox vulnerabilities in its SVGA graphics stack that could let a **privileged attacker inside a Windows guest** trigger out-of-bounds reads on the host. **`CVE-2020-2748`** affects VirtualBox `6.1.0 r135406` in the `VMSVGA/VBoxSVGA` video adapter path, where guest-controlled cursor update data can supply an unchecked screen identifier that is later used in `Display::i_displayVBVAReportCursorPosition`, causing an out-of-bounds access to `maFramebuffers[aScreenId]`. STAR Labs said the flaw was disclosed through ZDI and Oracle addressed it in its April 2020 security advisory. A separate bug, **`CVE-2019-3026`**, affects VirtualBox `6.0.4 r128413` and stems from improper validation of SVGA 3D commands in `vmsvgaFIFOLoop`. STAR Labs reported that a size-check macro failed to exit the intended switch block, allowing malformed command headers to bypass validation and trigger an integer underflow followed by an out-of-bounds read in `vmsvga3dShaderSetConst()`. Exploitation requires the attacker to already have high privileges in the guest, and for the VM to have **3D acceleration enabled**; Oracle fixed the issue in its October 2019 Critical Patch Update.
Jun 29, 2026
Oracle VirtualBox's emulated Intel PRO/1000 MT Desktop (`E1000`) network adapter was found to contain multiple security flaws that let attackers abuse packet-processing logic from inside a guest VM. One issue, tracked as **`CVE-2020-2894`**, affects VirtualBox 6.1.0 and stems from improper validation in `e1kInsertChecksum()`, allowing checksum operations to read beyond a packet buffer and disclose adjacent memory. By manipulating checksum end offsets, an attacker in a guest can leak host-side data incrementally through the virtual NIC path. A separate flaw, **`CVE-2019-2722`**, impacts VirtualBox 5.2.28 and earlier and 6.0.6 and earlier, where an integer underflow in `e1kFallbackAddToFrame()` can trigger a heap out-of-bounds write in host memory. An attacker with root or administrator privileges in the guest can craft transmit descriptors to corrupt host memory and potentially escape the VM to host ring 3. Both vulnerabilities were disclosed through Trend Micro Zero Day Initiative's **Pwn2Own** program, and Oracle released fixes through its security update process.
Jun 29, 2026