CVE-2025-62589: 
VirtualBox vulnerability analysis and mitigation

A vulnerability was discovered in Oracle VM VirtualBox (component: Core) affecting versions 7.1.12 and 7.2.2. The vulnerability (CVE-2025-62589) allows high-privileged attackers with logon access to the infrastructure where Oracle VM VirtualBox executes to compromise the system. The issue was disclosed in October 2025 and received a CVSS 3.1 Base Score of 8.2 (Oracle CPU).

The vulnerability is an integer overflow in the VMSVGA device component of VirtualBox. The specific flaw exists within the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. This vulnerability requires high privileges and local access to exploit (ZDI Advisory).

Successful exploitation of this vulnerability can result in complete takeover of Oracle VM VirtualBox. While the vulnerability is in VirtualBox, attacks may significantly impact additional products due to scope change. The vulnerability affects the confidentiality, integrity, and availability of the system with a CVSS vector of CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H (Oracle CPU).

Oracle has released patches to address this vulnerability in their October 2025 Critical Patch Update. Users are strongly advised to update to the patched versions of Oracle VM VirtualBox. The fix is available through the standard Oracle update channels (Oracle CPU).