ZDI-26-100: Oracle VirtualBox LsiLogic Uninitialized Memory Information Disclosure Vulnerability
This vulnerability allows local attackers to disclose sensitive information on affected installations of Oracle VirtualBox. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.0. The following CVEs are assigned: CVE-2026-21985.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-26-100?
The severity of ZDI-26-100 is classified as high due to its potential to allow local attackers to disclose sensitive information.
How do I fix ZDI-26-100?
To fix ZDI-26-100, ensure that you update Oracle VirtualBox to the latest version provided by Oracle.
Who is affected by ZDI-26-100?
Users of Oracle VirtualBox with installations that have not been patched are affected by ZDI-26-100.
What type of vulnerability is ZDI-26-100?
ZDI-26-100 is an uninitialized memory information disclosure vulnerability.
Can ZDI-26-100 be exploited remotely?
No, ZDI-26-100 requires local access to execute high-privileged code before any sensitive information can be disclosed.