CVE-2026-77178: Oracle VM VirtualBox vulnerability

Q: Who can trigger the vulnerability?

A user in a guest operating system can trigger the out-of-bounds write against the host OS through the emulated PCNet (Am79C970A) network device model.

Q: Which VirtualBox installations are affected?

Oracle VM VirtualBox versions before 7.2.8 are affected when the PCNet network device model is exposed to the guest.

Q: What is the impact on the host?

The flaw permits an out-of-bounds write in the host OS from a guest OS, occurring in pcnetReceiveNoSync in DevPCNet.cpp.

Published Oct 6, 2026

Updated

Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bounds write in the host OS in pcnetReceiveNoSync in DevPCNet.cpp in the PCNet (Am79C970A) network device model.

Affected Software

1 affected component

Oracle VM VirtualBox<7.2.8

Event History

Oct 6, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·02:17 PM

Description

Frequently Asked Questions

Who can trigger the vulnerability?

A user in a guest operating system can trigger the out-of-bounds write against the host OS through the emulated PCNet (Am79C970A) network device model.

Which VirtualBox installations are affected?

Oracle VM VirtualBox versions before 7.2.8 are affected when the PCNet network device model is exposed to the guest.

What is the impact on the host?

The flaw permits an out-of-bounds write in the host OS from a guest OS, occurring in pcnetReceiveNoSync in DevPCNet.cpp.

CVE-2026-77178: Oracle VM VirtualBox vulnerability

Affected Software

Event History

Frequently Asked Questions

Who can trigger the vulnerability?

Which VirtualBox installations are affected?

What is the impact on the host?

Company

Resources

Contact

Frequently Asked Questions

Who can trigger the vulnerability?

Which VirtualBox installations are affected?

What is the impact on the host?