CVE-2026-77178: Critical severity Oracle VM VirtualBox vulnerability
Published Oct 6, 2026
·Updated
Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bounds write in the host OS in pcnetReceiveNoSync in DevPCNet.cpp in the PCNet (Am79C970A) network device model.
Affected Software
1 affected component
Oracle VM VirtualBox<7.2.8
Event History
Oct 6, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·02:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can trigger the vulnerability?
A user in a guest operating system can trigger the out-of-bounds write against the host OS through the emulated PCNet (Am79C970A) network device model.
2
Which VirtualBox installations are affected?
Oracle VM VirtualBox versions before 7.2.8 are affected when the PCNet network device model is exposed to the guest.
3
What is the impact on the host?
The flaw permits an out-of-bounds write in the host OS from a guest OS, occurring in pcnetReceiveNoSync in DevPCNet.cpp.