Wiz
Vulnerability DatabaseCVE-2023-21991

CVE-2023-21991: 
VirtualBox vulnerability analysis and mitigation

Overview

CVE-2023-21991 is a vulnerability in Oracle VM VirtualBox's Core component affecting versions prior to 6.1.44 and prior to 7.0.8. The vulnerability was discovered by Bien Pham of Qrious Security working with Trend Micro's Zero Day Initiative and was disclosed in Oracle's April 2023 Critical Patch Update (Oracle CPU).

Technical details

The vulnerability exists within the handling of VGA MMIO (Memory-Mapped I/O) and results from the lack of proper validation of user-supplied data, which can lead to an out-of-bounds read condition. The vulnerability has been assigned a CVSS 3.1 base score of 3.2 (LOW) with the vector string CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N (ZDI Advisory).

Impact

Successful exploitation of this vulnerability can result in unauthorized read access to a subset of Oracle VM VirtualBox accessible data. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products due to scope change (Oracle CPU).

Mitigation and workarounds

Oracle has released security patches to address this vulnerability in VirtualBox versions 6.1.44 and 7.0.8. Users are strongly recommended to update to these patched versions (Oracle CPU).

Additional resources

Source: This report was generated using AI

Related VirtualBox vulnerabilities:

CVE ID

Severity

Score

Technologies

Component name

CISA KEV exploit

Has fix

Published date

CVE-2025-62641HIGH8.2
  • VirtualBoxVirtualBox
  • virtualbox
NoYesOct 21, 2025
CVE-2025-62590HIGH8.2
  • VirtualBoxVirtualBox
  • cpe:2.3:a:oracle:vm_virtualbox
NoYesOct 21, 2025
CVE-2025-62589HIGH8.2
  • VirtualBoxVirtualBox
  • cpe:2.3:a:oracle:vm_virtualbox
NoYesOct 21, 2025
CVE-2025-62592MEDIUM6
  • VirtualBoxVirtualBox
  • virtualbox
NoYesOct 21, 2025
CVE-2025-62591MEDIUM6
  • VirtualBoxVirtualBox
  • cpe:2.3:a:oracle:vm_virtualbox
NoYesOct 21, 2025

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Additional Wiz resources

Cloud Vulnerability DB

Cloud Vulnerability DB

A community-led vulnerabilities database

Cloud Threat Landscape

Cloud Threat Landscape

A threat intelligence database

PEACH

PEACH

A tenant isolation framework

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management
Get a demo