Out-of-Bounds Write Vulnerability in Oracle VM VirtualBox Network Device Model
CVE-2026-77178

9.1CRITICAL

Key Information:

Vendor

Oracle
Status
Oracle VM VirtualBox
Vendor
CVE Published:
6 October 2026

What is CVE-2026-77178?

An out-of-bounds write vulnerability exists in Oracle VM VirtualBox prior to version 7.2.8, allowing guest operating system users to exploit the PCNet (Am79C970A) network device model. This flaw enables the guest OS to write data beyond the allocated memory bounds in the host OS, potentially leading to system crashes, data loss, or unauthorized access to sensitive information. It is essential for users and administrators to update their installations to the latest version to mitigate the risks associated with this vulnerability.

References

https://www.oracle.com/
https://www.virtualbox.org/wiki/Download_Old_Builds_7_0
https://gist.github.com/entropy1337/cd0d5b368445d20c43aca...

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.