Oracle has published a patch release for its VirtualBox 7.2.18 virtualization system, which introduces 11 changes and fixes 19 vulnerabilities. The most serious issue (CVE-2026-87273) has been assigned a severity level of 8.6 out of 10, while five other issues, four of which are specific to Windows, assigned a severity level of 7.8 out of 10. Judging by the severity level, these vulnerabilities allow access to the host environment from the guest system. Details about the nature of the vulnerabilities are not disclosed.
Non-security related changes:
- In additions for guest systems and host environments with Linux Support for the kernel package from the RHEL 10.3 distribution has been implemented.
- In additions for guest systems with Linux Problems with building on systems with the kernel have been resolved Linux 6.12.103.
- In additions for host environments with Linux Resolved build issues in RHEL 9.8 and on systems with kernel Linux 7.3-rc, as well as on systems with AMD CPUs that do not support the Intel FRED (Flexible Return and Event Delivery) system call processing optimization mechanism.
- Crash fixed Windows 11 on ARM platforms when restoring a guest system from a saved state.
- Fixed data corruption in VDI images that occurred when reopening the image after writing zero-filled blocks to it.
- Fixed a virtual machine crash that occurred in host environments with Linux with 3D acceleration enabled.
- A bug in the Shared Clipboard implementation that caused the first character to disappear when copying files located in the root of the file system has been fixed.
Source: opennet.ru
