Loading vulnerability…
Unauthorized Data Access in Oracle VM VirtualBox Core
CVE-2025-21533 is a vulnerability in the Core component of Oracle VM VirtualBox. Affected versions include releases prior to 7.0.24 and prior to 7.1.6. The flaw is described as easily exploitable by a low-privileged attacker who already has logon access to the infrastructure where Oracle VM VirtualBox is running. Successful exploitation can compromise Oracle VM VirtualBox and lead to unauthorized access to sensitive data accessible through the product. The available information indicates a confidentiality-focused impact, but does not provide sufficient technical detail about the vulnerable function or root cause to characterize the flaw more precisely.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise Oracle VM VirtualBox and result in unauthorized access to critical data or complete access to all data accessible by Oracle VM VirtualBox. The published CVSS vector indicates high confidentiality impact, with no stated integrity or availability impact.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce local access to systems hosting Oracle VM VirtualBox, restrict logon rights to trusted administrators and users only, and minimize exposure of sensitive guest and host data through the platform. Additional hardening should include limiting who can interact with VirtualBox on the host and monitoring for suspicious local activity until the fixed version can be deployed. No specific vendor workaround is available in the provided information.
Patch, then assume compromise.
Upgrade Oracle VM VirtualBox to a fixed release. Affected versions are those prior to 7.0.24 and prior to 7.1.6, so remediation consists of updating to 7.0.24, 7.1.6, or later supported versions as appropriate. Oracle's January 2025 Critical Patch Update should be applied in accordance with vendor guidance.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.