ZDI-CAN-29271: ZDI-26-362: Oracle VirtualBox VMSVGA Stack-based Buffer Overflow Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Oracle VirtualBox. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2026-46873.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Prevent attackers from obtaining the ability to execute high-privileged code on VirtualBox guest systems: enforce least-privilege for guest accounts (remove administrative/root privileges from untrusted users), restrict installation or execution of untrusted software inside guests, and isolate/segment VMs that run untrusted workloads to reduce the chance an attacker can gain high-privileged code execution on a guest.
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-29271?
The severity of ZDI-CAN-29271 is rated at 7.5 according to the CVSS rating system.
How do I fix ZDI-CAN-29271?
To fix ZDI-CAN-29271, update Oracle VirtualBox to the latest version that contains the security patch addressing this vulnerability.
Who is affected by ZDI-CAN-29271?
ZDI-CAN-29271 affects users of Oracle VirtualBox who have systems vulnerable to local privilege escalation.
What type of vulnerability is ZDI-CAN-29271?
ZDI-CAN-29271 is a stack-based buffer overflow vulnerability that allows local privilege escalation.
What must an attacker do to exploit ZDI-CAN-29271?
An attacker must first obtain the ability to execute high-privileged code on the target guest system to exploit ZDI-CAN-29271.