CVE-2025-61760: 
VirtualBox vulnerability analysis and mitigation

A vulnerability has been identified in Oracle VM VirtualBox (component: Core), affecting versions 7.1.12 and 7.2.2. This vulnerability (CVE-2025-61760) was discovered and reported by Pavel Blinnikov and Andrey Chizhov, and was publicly disclosed on October 21, 2025 (Oracle CPU).

The vulnerability is classified as difficult to exploit and requires a low-privileged attacker with logon access to the infrastructure where Oracle VM VirtualBox executes. The vulnerability has been assigned a CVSS 3.1 Base Score of 7.5 (High severity) with the following vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H. This indicates Local access vector, High attack complexity, Low privileges required, and User interaction required, with a Changed scope (NVD).

Successful exploitation of this vulnerability can result in a complete takeover of Oracle VM VirtualBox. The vulnerability has potential impacts on confidentiality, integrity, and availability of the system. Additionally, while the vulnerability exists in VirtualBox, successful attacks may significantly impact additional products due to the scope change characteristic (Oracle CPU).

Oracle has released patches for the affected versions (7.1.12 and 7.2.2) as part of the October 2025 Critical Patch Update. Users are strongly advised to apply these security patches without delay to mitigate the risk of potential attacks (Oracle CPU).