We uncover vulnerability chain in Oracle VirtualBox

CVE-2025-62592 and CVE-2025-61760 rated 6.0 and 7.5 (CVSS 3.1), accordingly

October 22, 2025

The Oracle VirtualBox issues were discovered by our vulnerability research team. Their chain exploitation makes it possible to escape from a VirtualBox virtual machine to the ARM-based macOS host system. This is the first publicly disclosed vulnerability chain of this kind since the 2024 release of VirtualBox 7.1.0, which introduced ARM support for macOS.

The vulnerabilities were reported to the vendor in compliance with the responsible vulnerability disclosure policy. As a follow-up, Oracle released a Critical Patch Update (CPU) to fix the issues.

CVE-2025-62592 was discovered in the QemuRamFB virtual graphics adapter inside the qemuFwCfgMmioRead handler. It enables attackers to trigger an integer underflow (CWE-191) and read unlimited memory beyond the array. Thus, they can further gain access to sensitive data, including randomized base addresses for software and libraries. The vulnerability affects only VirtualBox for ARM-based macOS.

The other one, CVE-2025-61760, lies in the virtioCoreR3VirtqInfo function and involves stack buffer overflow. Attackers may leverage this vulnerability by using data obtained through the exploitation of CVE-2025-62592. They can then escape from a virtual machine to the host OS and execute arbitrary code to gain control over the hypervisor and other virtual machines. Ultimately, attackers can gain access to the Mac microphone and camera, read and modify any files stored on the device, including other application files. Control over almost the entire host OS makes it possible to start new processes.

Developing an exploit for modern applications commonly requires two vulnerabilities: for attackers to bypass ASLR and to corrupt process memory structures. The reported vulnerabilities work well together as a complete exploitation chain. While there are mitigations like NX (No-eXecute) and stack canary, the flaws can be leveraged by overwriting other local variables of the virtioCoreR3VirtqInfo function.

Pavel Blinnikov

Vulnerability Research Lead

Oracle VirtualBox is a type 2 hypervisor designed to virtualize guest operating systems. To prevent the exploitation of this vulnerability, VirtualBox should be updated to versions 7.2.4 and 7.1.14.