KLA89408 Multiple vulnerabilities in Oracle VirtualBox

🗓️ 21 Oct 2025 00:00:00Reported by Kaspersky LabType

kaspersky🔗 threats.kaspersky.com👁 9 Views

Multiple vulnerabilities in Oracle VirtualBox allow arbitrary code execution, information disclosure, and denial of service.

Reporter	Title	Published	Views	Family All 181
BDU FSTEC	The vulnerability of the “virtioCoreR3VirtqInfo” function in the “VBoxManage debugvm” command of the Oracle VM VirtualBox virtualization software is related to buffer overflow in the stack. This allows an attacker to execute arbitrary code and gain unauthorized access to the host system.	1 Sep 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the qemuFwCfgMmioRead function in the Box/Devices/PC/DevQemuFwCfg.cpp component of the Oracle VM VirtualBox virtualization software allows a malicious actor to gain unauthorized access to protected information.	22 Oct 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Core component of the Oracle VM VirtualBox software allows a hacker to gain full control over the application.	23 Oct 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Core component of the Oracle VM VirtualBox software allows a hacker to gain full control over the application.	23 Oct 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Core component of the Oracle VM VirtualBox software allows a hacker to gain full control over the application.	23 Oct 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Core component of the Oracle VM VirtualBox software allows a hacker to gain full control over the application.	23 Oct 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Core component of the Oracle VM VirtualBox software allows a hacker to gain full control over the application.	23 Oct 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Core component of the Oracle VM VirtualBox software allows a hacker to gain unauthorized access to protected information.	23 Oct 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of Oracle VM VirtualBox’s kernel allows a hacker to gain unauthorized access to data.	15 Dec 202500:00	–	bdu_fstec
Circl	CVE-2025-61759	27 Oct 202504:00	–	circl

Source	Link
oracle	www.oracle.com/security-alerts/cpuoct2025.html
threats	www.threats.kaspersky.com/en/product/Oracle-VirtualBox/
statistics	www.statistics.securelist.com/

22 Oct 2025 00:00Current

7.9High risk

Vulners AI Score7.9

CVSS 3.18.2

EPSS0.00191

SSVC