CVE-2026-87311: 
VirtualBox vulnerability analysis and mitigation

CVE-2026-87311 is a denial-of-service vulnerability in the Core component of Oracle VM VirtualBox, affecting version 7.2.16. It was disclosed on October 20, 2026, as part of Oracle's Critical Patch Update (CPU) for October 2026. The vulnerability allows a low-privileged local attacker to cause Oracle VM VirtualBox to hang or crash repeatedly, with potential scope change impacting additional products. It carries a CVSS v3.1 base score of 5.6 (Medium) (Oracle Advisory). The vulnerability was reported to Oracle by Tristan Madani of Talence Security (Oracle Advisory).

The vulnerability resides in the Core component of Oracle VM VirtualBox and is classified as a difficult-to-exploit local flaw. An attacker with low privileges and local logon access to the infrastructure where VirtualBox executes can trigger conditions that cause the VirtualBox process to hang or crash repeatedly (complete denial of service). The attack vector is local (AV:L), requires high attack complexity (AC:H), and no user interaction, but the scope is changed (S:C), meaning the impact can extend beyond VirtualBox itself to other products running on the same infrastructure. No specific CWE classification or detailed technical write-up has been publicly disclosed beyond the Oracle advisory (Oracle Advisory).

Successful exploitation results in a complete denial-of-service condition for Oracle VM VirtualBox — specifically, the ability to cause a hang or frequently repeatable crash of the VirtualBox process. There is no confidentiality or integrity impact. However, due to the changed scope, dependent or co-located products and virtual machines running on the affected VirtualBox infrastructure may also be disrupted, amplifying the availability impact beyond the hypervisor itself (Oracle Advisory).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been observed as of the time of disclosure. The EPSS score is reported as 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and high attack complexity, further limiting practical exploitability (Oracle Advisory).

Oracle has released a patch for this vulnerability as part of the October 2026 Critical Patch Update. Users should upgrade Oracle VM VirtualBox to a version beyond 7.2.16 (the advisory also references 7.2.20 as an affected version in the product listing, so upgrading to the latest patched release is recommended). As a temporary measure, Oracle recommends restricting local system access to trusted users only and monitoring VirtualBox processes for unexpected crashes or hangs. Oracle strongly advises applying the CPU patches as soon as possible rather than relying on workarounds (Oracle Advisory).