Oracle VirtualBox VirtioSCSI Vulnerability Allows Information Disclosure

Oracle VirtualBox, a widely used virtualization software, is facing scrutiny due to a newly disclosed information disclosure vulnerability within its VirtioSCSI implementation. Identified as CVE-2026-71114, this flaw presents a risk to users who rely on VirtualBox for running guest operating systems.

The vulnerability specifically resides in the VirtioSCSI driver, a component designed to provide efficient storage access for virtual machines. An out-of-bounds read error within this driver can be triggered under certain conditions. While the vulnerability does not allow for direct code execution or system compromise, it can be leveraged by an attacker who has already gained a high level of privilege within the guest operating system.

Exploitation requires an attacker to first achieve high-privileged code execution on the target guest system. Once this prerequisite is met, the attacker can then trigger the out-of-bounds read to potentially access and disclose sensitive information that should otherwise be protected. The exact nature and sensitivity of the disclosed information would depend on the specific data present in the guest's memory at the time of exploitation.

The Zero Day Initiative (ZDI), a prominent vulnerability research and disclosure program, has assigned a Common Vulnerability Scoring System (CVSS) score of 6.1 to this vulnerability. This score categorizes the vulnerability as 'Medium' severity, indicating a moderate risk. The CVSS score reflects factors such as the attack vector (local), privileges required (high), user interaction (none), and the impact on confidentiality (high).

While the vulnerability is classified as an information disclosure flaw, its impact can be significant depending on the context. Sensitive data such as configuration details, credentials, or other proprietary information residing within the guest OS could be exposed. This could potentially aid attackers in escalating privileges further, planning more targeted attacks, or exfiltrating valuable data.

Details of the vulnerability and its associated CVE identifier, CVE-2026-71114, have been published by the Zero Day Initiative. Users of Oracle VirtualBox are advised to monitor for any official security advisories or patches released by Oracle to address this issue. As with any disclosed vulnerability, prompt patching and adherence to security best practices are crucial for mitigating potential risks.

This disclosure highlights the ongoing need for robust security measures in virtualization environments. Even seemingly contained guest systems can be vulnerable to information leakage if underlying components have exploitable flaws. Organizations utilizing VirtualBox should ensure their guest operating systems and the VirtualBox software itself are kept up-to-date with the latest security patches.

This new advisory details a distinct vulnerability within Oracle VirtualBox, specifically an out-of-bounds read flaw in the VMSVGA graphics device, separate from the previously reported VirtioSCSI issue. While both vulnerabilities allow local attackers to disclose sensitive information on the guest system, this new flaw, tracked as CVE-2026-60162, has a CVSS score of 6.1.

This new advisory from Zero Day Initiative specifically assigns CVE-2026-71132 to the Oracle VirtualBox VirtioSCSI information disclosure vulnerability. The vulnerability has a CVSS score of 5.3 and requires high-privileged code execution on the guest system to be exploited.