CVE-2026-77178
UnknownSummary
Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bounds write in the host OS in pcnetReceiveNoSync in DevPCNet.cpp in the PCNet (Am79C970A) network device model.
Risk Assessment
A guest OS user can exploit this to cause an out-of-bounds write in the host OS, potentially leading to host crash or possibly code execution on the host.
Recommendation
Upgrade Oracle VM VirtualBox to version 7.2.8 or later, which fixes the issue. Restrict access to virtual machines to trusted users only.
Other vulnerabilities in Oracle VM VirtualBox
See all- CVE-2026-21990High
A vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. It is easily exploitable by a high privileged attacker with logon to the infrastructure where VirtualBox executes. Successful attacks can result in takeover of VirtualBox, and may significantly impact additional products (scope change). CVSS 3.1 Base Score is 8.2.
- CVE-2026-21989High
A vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. It is easily exploitable by a high privileged attacker with logon to the infrastructure where VirtualBox executes. Successful attacks can result in unauthorized creation, deletion or modification of data, unauthorized access to data, and partial denial of service. CVSS 3.1 Base Score is 8.1.
- CVE-2026-21988High
Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. A high-privileged attacker with local access can take over VirtualBox, and the attack may impact other products (scope change).
- CVE-2026-21987High
Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. A high-privileged attacker with local access can take over VirtualBox, and the attack may impact other products (scope change).
- CVE-2026-21986High
Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. An unauthenticated attacker with local access can cause a hang or frequently repeatable crash (complete DoS) of VirtualBox. This vulnerability applies to Windows VMs only.
- CVE-2026-21984High
Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. A high-privileged attacker with local access can take over VirtualBox, but exploitation is difficult. The attack may impact other products (scope change).
- CVE-2026-21983High
Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. A high-privileged attacker with local access can take over VirtualBox, but exploitation is difficult. The attack may impact other products (scope change).
- CVE-2026-21982High
Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. An unauthenticated attacker with access to the physical communication segment attached to the hardware where VirtualBox executes can take over VirtualBox. Exploitation is difficult.
- CVE-2026-21957High
Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. It is difficult to exploit, requires high-privileged local access, but can lead to full takeover of VirtualBox. Attacks may impact additional products (scope change).
- CVE-2026-21956High
Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. An attacker with high privileges and local access to the infrastructure can easily exploit this flaw, potentially leading to takeover of Oracle VM VirtualBox. The vulnerability has a scope change, meaning attacks may also impact additional products.
Original NVD description (English source)
Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bounds write in the host OS in pcnetReceiveNoSync in DevPCNet.cpp in the PCNet (Am79C970A) network device model.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS