CVE-2025-61760: High severity Oracle VM VirtualBox vulnerability

Published Oct 21, 2025

Updated

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.12 and 7.2.2. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H).

Affected Software

3 affected components

Oracle VM VirtualBox

Oracle VM VirtualBox=7.1.12

Oracle VM VirtualBox=7.2.2

Event History

Oct 21, 2025

CVE Published

via MITRE·08:03 PM

Data Sourced

via MITRE·08:03 PM

DescriptionSeverity

Data Sourced

via NVD·08:20 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-61760?

CVE-2025-61760 is categorized as a difficult to exploit vulnerability with potential risks for low privileged attackers.

How do I fix CVE-2025-61760?

To mitigate CVE-2025-61760, upgrade Oracle VM VirtualBox to version 7.1.13 or 7.2.3 or later.

Which versions of Oracle VM VirtualBox are affected by CVE-2025-61760?

CVE-2025-61760 affects Oracle VM VirtualBox versions 7.1.12 and 7.2.2.

Can CVE-2025-61760 be exploited remotely?

CVE-2025-61760 requires a low privileged attacker with local logon access, making it difficult to exploit remotely.

What components of Oracle VM VirtualBox are impacted by CVE-2025-61760?

CVE-2025-61760 impacts the Core component of Oracle VM VirtualBox.