Multiple Vulnerabilities Discovered in Oracle VirtualBox

A series of vulnerabilities affecting Oracle VirtualBox have been disclosed, allowing local attackers to escalate privileges or disclose sensitive information. The vulnerabilities, identified as ZDI-26-639, ZDI-26-640, ZDI-26-641, ZDI-26-642, ZDI-26-643, and ZDI-26-644, require attackers to execute high-privileged code on the target guest system. The flaws primarily involve improper validation of user-supplied data and lack of memory initialization or locking. Oracle has released updates to address these vulnerabilities. The vulnerabilities were reported to the vendor between June and July 2026, with public advisories released on September 9, 2026. Security professionals are advised to apply the updates promptly to mitigate risks.

Key Points: • Six vulnerabilities in Oracle VirtualBox disclosed, affecting local installations. • Attackers need high-privileged code execution on the guest system to exploit these flaws. • Oracle has issued patches for all identified vulnerabilities as of September 9, 2026.