CVE-2026-47044 Overview
CVE-2026-47044 is a denial-of-service vulnerability affecting the Core component of Oracle VM VirtualBox. The flaw exists in supported version 7.2.12 and is categorized under [CWE-400] Uncontrolled Resource Consumption. A low-privileged attacker with local logon access to the host running Oracle VM VirtualBox can trigger the condition without user interaction. Successful exploitation causes a hang or repeatable crash, producing a complete denial of service of the VirtualBox process. The vulnerability does not impact confidentiality or integrity but has a high availability impact. Oracle disclosed the issue in the July 2026 Critical Patch Update.
Critical Impact
Local attackers with low privileges can crash or hang Oracle VM VirtualBox 7.2.12, disrupting virtualized workloads on affected hosts.
Affected Products
- Oracle VM VirtualBox 7.2.12
- Oracle Virtualization (Core component)
- Hosts running the affected VirtualBox version across supported operating systems
Discovery Timeline
- 2026-07-21 - CVE-2026-47044 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-47044
Vulnerability Analysis
The vulnerability resides in the Core component of Oracle VM VirtualBox 7.2.12, which handles low-level virtualization primitives including virtual CPU state, memory management, and device emulation. The weakness is classified as [CWE-400] Uncontrolled Resource Consumption, meaning that specific operations invoked from a guest or local process consume host resources without proper bounds. When triggered, the condition either causes the VirtualBox process to hang or to crash in a frequently repeatable manner. Because the vulnerability sits in the Core component, all running virtual machines on the affected host lose availability at once. Oracle rates the flaw as easily exploitable in its July 2026 Critical Patch Update advisory.
Root Cause
The root cause is uncontrolled resource consumption within the VirtualBox Core, where a low-privileged local user can drive the hypervisor into an unstable state. Oracle has not published implementation-level detail, but the CWE-400 classification points to missing rate limits, missing size checks, or unbounded allocations in a code path reachable from a local session. See the Oracle Security Alert - July 2026 for the official write-up.
Attack Vector
Exploitation requires local access. An attacker must authenticate to the host operating system with any account that can interact with the VirtualBox process or its APIs. No user interaction from an administrator is required, and the attack scope remains unchanged. From this position, the attacker issues the crafted operation that exhausts a Core resource, producing a hang or crash of the hypervisor. Remote exploitation over the network is not possible without prior local access.
No public proof-of-concept or exploit code is available for CVE-2026-47044 at the time of writing. Refer to the vendor advisory for technical details.
Detection Methods for CVE-2026-47044
Indicators of Compromise
- Unexpected termination or hang of VBoxHeadless, VirtualBox, or VBoxSVC processes on hosts running version 7.2.12.
- Repeated crash dumps or Windows Event Log / Linux journald entries referencing VirtualBox Core modules.
- Multiple guest VMs on the same host losing power state simultaneously without an administrative action.
Detection Strategies
- Monitor host process telemetry for abnormal exit codes and repeated restarts of VirtualBox services.
- Alert on local logons by low-privileged accounts that are followed by VirtualBox API or CLI activity outside expected baselines.
- Correlate hypervisor crash events with recent execution of unsigned or unusual binaries by non-administrative users.
Monitoring Recommendations
- Enable host-level auditing for process creation and termination events involving VirtualBox executables.
- Forward VirtualBox log files under the user's .config/VirtualBox or %USERPROFILE%\.VirtualBox directories to a centralized log store for retention and analysis.
- Track version inventory of Oracle VM VirtualBox across the estate and flag hosts still running 7.2.12.
How to Mitigate CVE-2026-47044
Immediate Actions Required
- Apply the fix published in the Oracle Security Alert - July 2026 Critical Patch Update.
- Inventory all hosts running Oracle VM VirtualBox 7.2.12 and prioritize patching multi-tenant or production virtualization hosts.
- Restrict interactive and remote logon rights on VirtualBox hosts to trusted administrative users only.
Patch Information
Oracle addressed CVE-2026-47044 as part of the July 2026 Critical Patch Update. Administrators should upgrade Oracle VM VirtualBox to the fixed release identified in the advisory. Consult the Oracle Security Alert - July 2026 for the specific patched version and platform-specific installers.
Workarounds
- Limit local access to VirtualBox hosts by removing non-essential user accounts and enforcing least privilege.
- Disable or gate access to the VirtualBox management APIs and CLI tools for users who do not require them.
- Where patching is delayed, isolate critical virtual machines onto hosts not exposed to untrusted local users.
# Verify installed VirtualBox version on Linux/macOS/Windows
VBoxManage --version
# Linux example: restrict access to VirtualBox binaries to the vboxusers group
sudo chgrp vboxusers /usr/lib/virtualbox/VBoxHeadless /usr/lib/virtualbox/VBoxSVC
sudo chmod 750 /usr/lib/virtualbox/VBoxHeadless /usr/lib/virtualbox/VBoxSVC
# Audit which local users can invoke VirtualBox
getent group vboxusers
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
