Introduction
A local attacker with high privileges can fully compromise Oracle VM VirtualBox on affected systems, and the impact may reach other products beyond the virtualization environment. The vulnerability is tracked as CVE-2025-62589. Oracle disclosed it in the October 2025 Critical Patch Update and rated it high severity, with a CVSS 3.1 base score of 8.2.
Oracle VM VirtualBox is an open-source virtualization platform maintained by Oracle. It runs on Windows, macOS, Linux, and Solaris hosts and is widely used in enterprise, development, and educational environments worldwide.
Technical information
CVE-2025-62589 affects the Core component of Oracle VM VirtualBox. Oracle's advisory describes it as easily exploitable by a high-privileged attacker who has local logon to the infrastructure where VirtualBox executes, and says that attacker can compromise the product. It is not remotely exploitable and does not require user interaction. The CVSS vector is AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, which breaks down as:
- Local attack vector
- Low attack complexity
- High privileges required
- No user interaction
- Changed scope (the impact extends to additional products)
- High impact on confidentiality, integrity, and availability
Oracle's advisory gives no further technical details and no code snippets. No public proof of concept or root cause analysis is available at this time.
Affected systems and versions
Oracle's October 2025 CPU advisory lists Oracle VM VirtualBox versions 7.1.12 and 7.2.2 as vulnerable, and only those versions. Systems running either version are at risk on every supported platform: Windows, macOS, Linux, and Solaris.
Vendor security history
Oracle regularly fixes privilege escalation and VM escape vulnerabilities in VirtualBox through its quarterly Critical Patch Update program. Earlier CPUs included similar vulnerabilities in the Core component, among them CVE-2025-53024 through CVE-2025-53030 (July 2025 CPU) and CVE-2025-30725 (April 2025 CPU). Oracle typically publishes high-level risk matrices and patch guidance, and keeps detailed technical information out of its public advisories.
