ZDI-CAN-30083: ZDI-26-644: Oracle VirtualBox VMSVGA Race Condition Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Oracle VirtualBox. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2026-60155.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need before exploiting this issue?
The attacker must first be able to execute high-privileged code on the target guest system. This is therefore not described as an unauthenticated or low-privilege guest compromise path.
Which systems are directly exposed?
Affected Oracle VirtualBox installations are exposed where an attacker can execute high-privileged code inside the target guest system. The available information does not identify affected versions, host platforms, or configuration-specific conditions.
How can I determine whether an installation is affected?
The provided information identifies Oracle VirtualBox but does not list affected or fixed versions. Confirm the installed version and patch status against Oracle's security guidance for CVE-2026-60155.