CVE-2022-39426: 
VirtualBox vulnerability analysis and mitigation

Oracle VM VirtualBox prior to version 6.1.40 contains a security vulnerability (CVE-2022-39426) in its Core component. This vulnerability allows unauthenticated attackers with network access via VRDP (Virtual Remote Desktop Protocol) to potentially take complete control of the VirtualBox system (Oracle CPU, NVD).

The vulnerability is classified with a CVSS v3.1 Base Score of 8.1 (High) and vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. The specific flaw exists within the handling of smartcard I/O messages. The issue results from the lack of validating the existence of an object prior to performing further free operations on the object, leading to a double free condition (ZDI Advisory).

Successful exploitation of this vulnerability can result in complete takeover of Oracle VM VirtualBox, potentially allowing attackers to execute arbitrary code in the context of the RDP service (ZDI Advisory, Oracle CPU).

Oracle has released version 6.1.40 of VirtualBox to address this vulnerability. Users are strongly advised to upgrade to this version or later to mitigate the risk (Gentoo Advisory, Oracle CPU).