ZDI-CAN-27925: ZDI-26-099: Oracle VirtualBox VMSVGA Race Condition Local Privilege Escalation Vulnerability

Published Feb 13, 2026

Updated

This vulnerability allows local attackers to escalate privileges on affected installations of Oracle VirtualBox. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2026-21984.

Affected Software

1 affected component

Oracle VirtualBox

Event History

Feb 13, 2026

Advisory Published

via ZDI·06:00 AM

Data Sourced

via ZDI·06:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-27925?

The severity of ZDI-CAN-27925 is classified as critical due to its potential for local privilege escalation.

How do I fix ZDI-CAN-27925?

To fix ZDI-CAN-27925, apply the latest security patches provided by Oracle for VirtualBox.

What versions of Oracle VirtualBox are affected by ZDI-CAN-27925?

ZDI-CAN-27925 affects all versions of Oracle VirtualBox prior to the patch release that addresses the vulnerability.

How does ZDI-CAN-27925 impact system security?

ZDI-CAN-27925 allows local attackers to escalate privileges, potentially gaining unauthorized control of the host system.

Is ZDI-CAN-27925 easy to exploit?

Exploiting ZDI-CAN-27925 requires that an attacker already has the ability to execute high-privileged code on the target guest.