CVE-2026-87303: Oracle VM VirtualBox Core DOS Vulnerability

CVE-2026-87303 Overview

CVE-2026-87303 is a denial-of-service vulnerability in the Core component of Oracle VM VirtualBox. The flaw affects version 7.2.16 and allows a low-privileged attacker with local logon access to the infrastructure running VirtualBox to trigger a hang or repeatable crash of the hypervisor. Successful exploitation requires user interaction from a party other than the attacker. Although the vulnerability resides in VirtualBox, the attack causes a scope change and can significantly affect additional products running on the host. The impact is limited to availability, with no confidentiality or integrity consequences.

Critical Impact
A local, low-privileged attacker can cause a complete denial of service of Oracle VM VirtualBox, disrupting all guest workloads hosted on the affected hypervisor.

Affected Products

Oracle VM VirtualBox version 7.2.16
Oracle Virtualization product family (Core component)
Workloads and guest VMs dependent on the affected hypervisor host

Discovery Timeline

2026-10-20 - CVE-2026-87303 published to the National Vulnerability Database
2026-10-21 - Last updated in NVD database
October 2026 - Addressed in the Oracle Critical Patch Update advisory

Technical Details for CVE-2026-87303

Vulnerability Analysis

The vulnerability resides in the Core component of Oracle VM VirtualBox 7.2.16. An attacker with a local account on the host where VirtualBox executes can trigger conditions that cause the hypervisor to hang or crash. The flaw is categorized as a denial-of-service issue, affecting availability only. Exploitation requires action from a second user on the system, such as launching or interacting with a VM. The scope change indicator in the CVSS vector reflects that the impact extends beyond the vulnerable component, disrupting guest virtual machines and dependent services on the host.

Root Cause

Oracle has not published the specific technical root cause for CVE-2026-87303. Based on the Oracle Critical Patch Update October 2026 advisory, the defect resides in the VirtualBox Core subsystem, which manages the lifecycle of virtual machines, device emulation, and hypervisor state. Improper handling of specific inputs or operations leads to an unrecoverable fault that terminates or hangs the VirtualBox process.

Attack Vector

The attack vector is local. The attacker must authenticate to the host operating system where VirtualBox runs with low privileges. The attacker then triggers the vulnerable code path, which requires another user to perform an interactive action. The result is a complete denial of service of the VirtualBox hypervisor, terminating active virtual machines without warning. For additional technical context, see the Oracle Security Alert October 2026.

Detection Methods for CVE-2026-87303

Indicators of Compromise

Unexpected termination or hang of the VirtualBox or VBoxHeadless process on the host
Guest virtual machines entering an aborted state without administrator action
Repeated crash dumps or stack traces originating from VirtualBox Core modules

Detection Strategies

Monitor host process telemetry for abnormal exits of VirtualBox binaries by low-privileged users
Correlate guest VM state transitions with concurrent interactive sessions on the host
Alert on repeated VirtualBox service restarts within a short time window

Monitoring Recommendations

Enable host-based logging for VirtualBox events including VBox.log and system crash reports
Track local logon activity on hosts running VirtualBox and correlate with hypervisor availability events
Baseline normal VM uptime patterns to detect anomalous repeated crashes

How to Mitigate CVE-2026-87303

Immediate Actions Required

Apply the fix provided in the Oracle Critical Patch Update October 2026 to all hosts running Oracle VM VirtualBox 7.2.16
Restrict local logon rights on VirtualBox hosts to trusted administrators only
Review and reduce the number of users with interactive access to systems hosting production VMs

Patch Information

Oracle addressed CVE-2026-87303 in the October 2026 Critical Patch Update. Administrators should upgrade Oracle VM VirtualBox beyond version 7.2.16 to a release containing the fix. Refer to the Oracle Security Alert October 2026 for version-specific guidance and download links.

Workarounds

Limit interactive host access to VirtualBox servers using operating system access controls
Isolate VirtualBox hosts on dedicated infrastructure where only authorized operators can log on
Suspend non-essential VirtualBox services on multi-user systems until patching is complete

bash

# Verify installed VirtualBox version and plan upgrade
VBoxManage --version
# If output reports 7.2.16, schedule upgrade to the patched release
# per Oracle Critical Patch Update October 2026