ZDI-26-101: Oracle VirtualBox BusLogic Uninitialized Memory Information Disclosure Vulnerability
This vulnerability allows local attackers to disclose sensitive information on affected installations of Oracle VirtualBox. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.0. The following CVEs are assigned: CVE-2026-21963.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-26-101?
The severity of ZDI-26-101 is categorized as high due to its potential for disclosing sensitive information.
How do I fix ZDI-26-101?
To fix ZDI-26-101, update to the latest version of Oracle VirtualBox where the vulnerability has been patched.
Who is affected by ZDI-26-101?
ZDI-26-101 affects users of Oracle VirtualBox who have installations that allow local attackers to execute high-privileged code.
What type of vulnerability is ZDI-26-101?
ZDI-26-101 is an uninitialized memory information disclosure vulnerability that can lead to sensitive data leaks.
Can ZDI-26-101 be exploited remotely?
No, ZDI-26-101 requires local access to exploit, as attackers must execute high-privileged code on the affected system.