Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-62590: Oracle VirtualBox can be taken over by local admin

CVE-2025-62590 · published 1 year ago

Summary

The core component of Oracle VirtualBox versions 7.1.12 and 7.2.2 can be hijacked by someone who already has administrator access on the host machine. This could let the attacker control the VirtualBox service and potentially affect other software that relies on it. Apply the latest security updates from Oracle as soon as possible and limit administrative logins to trusted users.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	oracle	vm_virtualbox	7.1.12 7.2.2 `cpe:2.3:a:oracle:vm_virtualbox:7.1.12:::::::*`
Ubuntu:16.04:LTS	canonical	virtualbox	All versions

Original advisory text

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.12 and 7.2.2. Easily exploitable vulnerability allows hig...

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.12 and 7.2.2. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

References

https://ubuntu.com/security/CVE-2025-62590 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2025-62590 Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2025.html Third Party Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.2 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-267Privilege Defined With Unsafe Actions

Timeline

Published21 Oct 2025

Updated29 Oct 2026

First seen7 Mar 2026

Sources

CVE-2025-62590 · NVD

UBUNTU-CVE-2025-62590 · OSV

Track software like this

Free during beta