CVE-2025-62590: High severity Oracle VM VirtualBox vulnerability

Published Oct 21, 2025

Updated

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.12 and 7.2.2. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

Affected Software

3 affected components

Oracle VM VirtualBox

Oracle VM VirtualBox=7.1.12

Oracle VM VirtualBox=7.2.2

Event History

Oct 21, 2025

CVE Published

via MITRE·08:03 PM

Data Sourced

via MITRE·08:03 PM

DescriptionSeverity

Data Sourced

via NVD·08:20 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-62590?

CVE-2025-62590 is considered easily exploitable, allowing high-privilege attackers to compromise Oracle VM VirtualBox environments.

Which versions of Oracle VM VirtualBox are affected by CVE-2025-62590?

The affected versions for CVE-2025-62590 are Oracle VM VirtualBox 7.1.12 and 7.2.2.

How do I fix CVE-2025-62590?

To fix CVE-2025-62590, you should update Oracle VM VirtualBox to the latest version released by Oracle.

Who can exploit CVE-2025-62590?

CVE-2025-62590 can be exploited by high-privileged attackers who have logon access to the infrastructure where Oracle VM VirtualBox is executed.

What component of Oracle Virtualization is affected by CVE-2025-62590?

The core component of Oracle VM VirtualBox is affected by CVE-2025-62590.