ZDI-26-641: Oracle VirtualBox VirtioSCSI Out-Of

Zerodayinitiative • September 9, 2026

This vulnerability allows local attackers to disclose sensitive information on affected installations of Oracle VirtualBox. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability.

The specific flaw exists within the VirtioSCSI device. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to disclose information in the context of the hypervisor.

Oracle has issued an update to correct this vulnerability. More details can be found at:

2026-07-24 - Vulnerability reported to vendor

2026-09-09 - Coordinated public release of advisory

2026-09-09 - Advisory Updated

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Vulnerabilities Discovered in Oracle VirtualBox A series of vulnerabilities affecting Oracle VirtualBox have been disclosed, allowing local attackers to escalate privileges or disclose sensitive information. The vulnerabilities, identified as ZDI-26-639, ZDI-26-640, ZDI-26-641, ZDI-26-642, ZDI-26-643, and ZDI-26-644, require attackers to execute high-privileged code on the target guest system. The flaws primarily involve improper validation of user-supplied data and lack of memory initialization or locking. Oracle has released updates to address these vulnerabilities. The vulnerabilities were reported to the vendor between June and July 2026, with public advisories released on September 9, 2026. Security professionals are advised to apply the updates promptly to mitigate risks. 6 sources 46

Extracted Entities

ZDI-26-641: Oracle VirtualBox VirtioSCSI Out-Of

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CWE Weaknesses (1)

Platforms (1)