CVE-2026-46816: Infoleak
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA device). The supported version that is affected is 7.2.8. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 3.2 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
If VMSVGA is not required for VM operation, disable the VMSVGA graphics device for affected VMs or select a non‑VMSVGA graphics controller in the VM settings to avoid exposure to the VMSVGA vulnerability.
Oracle VM VirtualBox (VMSVGA device) graphics controller / VMSVGA = disabled if not required - Compensating control
Restrict and harden access to hosts running Oracle VM VirtualBox: limit administrative/logon access to trusted accounts, apply network segmentation and firewall/ACL rules to management interfaces, and isolate VirtualBox hosts from untrusted networks to reduce the chance of a local high‑privileged attacker exploiting the VMSVGA vulnerability.
- Operational
Monitor and audit VirtualBox hosts and guest VMs for suspicious activity and unauthorized read attempts, and review logs for signs of compromise given the vulnerability can allow unauthorized read access to VM‑accessible data.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46816?
The severity of CVE-2026-46816 is classified as low with a score of 3.2.
What components are affected by CVE-2026-46816?
CVE-2026-46816 affects the VMSVGA device in Oracle VM VirtualBox version 7.2.8.
Who can exploit CVE-2026-46816?
CVE-2026-46816 can be exploited by a high privileged attacker with logon access to the infrastructure where Oracle VM VirtualBox is running.
What type of vulnerability is CVE-2026-46816?
CVE-2026-46816 is classified as an info leak vulnerability.
How do I fix CVE-2026-46816?
To mitigate CVE-2026-46816, users should upgrade to a patched version of Oracle VM VirtualBox.