CVE-2025-61760: Oracle VM VirtualBox Privilege Escalation

CVE-2025-61760 Overview

CVE-2025-61760 is a high-severity vulnerability in the Core component of Oracle VM VirtualBox. The flaw affects Oracle VM VirtualBox versions 7.1.12 and 7.2.2. A low-privileged attacker with local logon access to the host running VirtualBox can exploit this issue, though exploitation requires human interaction from another user and is difficult to execute.

Successful exploitation can result in full takeover of Oracle VM VirtualBox. Because the vulnerability produces a scope change, exploitation may impact additional products beyond VirtualBox itself, affecting confidentiality, integrity, and availability of the guest and host environment.

Critical Impact
Successful attacks can lead to complete compromise of Oracle VM VirtualBox with scope change, allowing impact on additional products outside VirtualBox's security boundary.

Affected Products

Oracle VM VirtualBox version 7.1.12
Oracle VM VirtualBox version 7.2.2
Oracle Virtualization (Core component)

Discovery Timeline

2025-10-21 - CVE-2025-61760 published to the National Vulnerability Database (NVD)
2025-10-21 - Oracle released the October 2025 Critical Patch Update addressing this issue
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-61760

Vulnerability Analysis

The vulnerability resides in the Core component of Oracle VM VirtualBox, the type-2 hypervisor responsible for managing virtual machine execution on host systems. The flaw is classified under [CWE-284] Improper Access Control, indicating that VirtualBox fails to correctly enforce security restrictions on privileged operations.

Exploitation requires the attacker to already possess low-privileged credentials on the host system where VirtualBox executes. The attack complexity is high, meaning the attacker must overcome non-trivial conditions outside their direct control. Additionally, a second user must perform an action for the exploit chain to succeed.

The scope change indicator means a successful compromise crosses the security boundary of VirtualBox itself, allowing the attacker to affect resources managed by other components on the host.

Root Cause

The root cause is improper access control (CWE-284) within the VirtualBox Core component. The hypervisor does not sufficiently validate or enforce permission boundaries on certain privileged operations, allowing a locally authenticated user to escalate impact beyond their assigned privileges when a second user interacts with the affected functionality.

Attack Vector

The attack requires local access to the host system running Oracle VM VirtualBox. An attacker with a valid low-privileged account on the host must trigger the vulnerable code path and rely on human interaction from another user, such as a VM administrator or another logged-in user, to complete the exploitation chain. Successful exploitation results in takeover of the VirtualBox instance and potential impact on adjacent components due to the scope change.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Oracle Security Alert - October 2025 for vendor-supplied technical detail.

Detection Methods for CVE-2025-61760

Indicators of Compromise

Unexpected modifications to VirtualBox configuration files (.vbox, VirtualBox.xml) by non-owner accounts on the host.
Anomalous execution of VirtualBox binaries such as VBoxManage, VBoxHeadless, or VirtualBox under low-privileged user contexts followed by privileged actions.
Unusual child processes spawned by VBoxSVC or the VirtualBox service daemon.

Detection Strategies

Monitor host process trees for VirtualBox components launching unexpected system utilities or shells.
Audit file access on VirtualBox installation directories and per-user .config/VirtualBox folders for cross-user tampering.
Correlate local logon events with subsequent VirtualBox API or command invocations to identify unauthorized use.

Monitoring Recommendations

Enable host-level process, file, and command-line telemetry on all systems running affected VirtualBox versions.
Alert on any changes to VirtualBox extension packs or shared folder configurations performed by non-administrative accounts.
Track multi-user interaction patterns on shared hosts where VirtualBox is deployed, as exploitation requires a second user's action.

How to Mitigate CVE-2025-61760

Immediate Actions Required

Apply the Oracle Critical Patch Update from October 2025 to upgrade Oracle VM VirtualBox beyond the affected versions 7.1.12 and 7.2.2.
Inventory all endpoints and servers running Oracle VM VirtualBox and prioritize hosts that permit interactive logon by multiple users.
Restrict local logon rights on VirtualBox hosts to trusted administrative accounts only.

Patch Information

Oracle addressed this vulnerability in the Oracle Security Alert - October 2025. Administrators should upgrade Oracle VM VirtualBox to the fixed release listed in the Critical Patch Update advisory. Verify the installed version using VBoxManage --version after upgrade.

Workarounds

Limit local user accounts on hosts running VirtualBox to reduce the pool of potential low-privileged attackers.
Avoid running VirtualBox on multi-user systems until the patch is applied, since exploitation requires interaction from a second user.
Enforce least-privilege for accounts that interact with VirtualBox and disable unused VirtualBox features such as shared folders or extension packs where not required.

bash

# Verify installed VirtualBox version and upgrade guidance
VBoxManage --version

# On Linux, upgrade using the distribution package manager after Oracle releases the patched build
sudo apt-get update && sudo apt-get install --only-upgrade virtualbox-7.1

# Restrict interactive logon on the host (Linux example)
sudo passwd -l <untrusted_user>