ZDI 2026-02-13

ZDI-26-101: Oracle VirtualBox BusLogic Uninitialized Memory Information Disclosure Vulnerability

CVE-2026-21963

From Zero Day Initiative ↗

This vulnerability allows local attackers to disclose sensitive information on affected installations of Oracle VirtualBox. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.0. The following CVEs are assigned: CVE-2026-21963.

Read the full advisory on ZDI →

Related advisories

2026-06-24 ZDI ZDI-26-362: Oracle VirtualBox VMSVGA Stack-based Buffer Overflow Local Privilege Escalation Vulnerability The vulnerability is a stack-based buffer overflow in Oracle VirtualBox's VMSVGA component, requiring high-privileged code execution in the guest…
2026-04-28 ZDI ZDI-26-306: Oracle VirtualBox SoundBlaster 16 Race Condition Local Privilege Escalation Vulnerability The vulnerability requires a local attacker to already have high-privileged code execution on the guest system. The ZDI assigned a CVSS rating of…
2026-02-13 ZDI ZDI-26-097: Oracle VirtualBox VMSVGA Heap-based Buffer Overflow Local Privilege Escalation Vulnerability The vulnerability requires prior execution of high-privileged code on the guest. The heap-based buffer overflow occurs in the VMSVGA component.
2026-02-13 ZDI ZDI-26-098: Oracle VirtualBox VMSVGA Use-After-Free Local Privilege Escalation Vulnerability This vulnerability requires prior high-privileged code execution on a guest system to escalate privileges. The ZDI assigned a CVSS rating of 8.2.
2026-02-13 ZDI ZDI-26-099: Oracle VirtualBox VMSVGA Race Condition Local Privilege Escalation Vulnerability Requires prior high-privileged code execution on the guest system. Exploitation is constrained to a race condition within the VMSVGA component.