ZDI-26-644: Oracle VirtualBox VMSVGA Race Condition Local Privilege Escalation Vulnerability

Zerodayinitiative • September 9, 2026

This vulnerability allows local attackers to escalate privileges on affected installations of Oracle VirtualBox. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability.

The specific flaw exists within the VMSVGA device. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor.

Oracle has issued an update to correct this vulnerability. More details can be found at:

2026-06-25 - Vulnerability reported to vendor

2026-09-09 - Coordinated public release of advisory

2026-09-09 - Advisory Updated

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Vulnerabilities Discovered in Oracle VirtualBox A series of vulnerabilities affecting Oracle VirtualBox have been disclosed, allowing local attackers to escalate privileges or disclose sensitive information. The vulnerabilities, identified as ZDI-26-639, ZDI-26-640, ZDI-26-641, ZDI-26-642, ZDI-26-643, and ZDI-26-644, require attackers to execute high-privileged code on the target guest system. The flaws primarily involve improper validation of user-supplied data and lack of memory initialization or locking. Oracle has released updates to address these vulnerabilities. The vulnerabilities were reported to the vendor between June and July 2026, with public advisories released on September 9, 2026. Security professionals are advised to apply the updates promptly to mitigate risks. 6 sources 46

Extracted Entities

ZDI-26-644: Oracle VirtualBox VMSVGA Race Condition Local Privilege Escalation Vulnerability

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (2)

MITRE ATT&CK (1)

Platforms (1)

Vulnerabilities (1)