CVE-2025-62591
Oracle Vm Virtualbox 7.1.12 … 7.2.2
Raw vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:NSummary
CVE-2025-62591 is a medium-severity Privilege Defined With Unsafe Actions (CWE-267) vulnerability in Oracle Vm Virtualbox. Its CVSS base score is 6.0 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-35235
Vulnerability Data
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.12 and 7.2.2. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise…
more
Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CWE-267 (Privilege Defined With Unsafe Actions) in a hypervisor core component allows a high-privileged local attacker to access critical data outside the VM, mapping to local privilege escalation (T1068) and data collection from the local system (T1005).
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly counters CWE-267 by restricting the excessive host privileges that a local high-privileged attacker relies on to reach VirtualBox data outside intended scope.
Enforces access-control decisions so that even an authenticated high-privileged process on the infrastructure cannot obtain unauthorized confidentiality access to VirtualBox data.
Strengthens process isolation between VirtualBox components and the host OS, limiting the scope-change impact described in the CVE when privilege abuse occurs.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Defining and enforcing least-privilege permissions directly reduces the chance that a privilege permits unintended unsafe actions.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Use of privileged utility programs restricts dangerous tools but does not address unsafe actions within assigned privileges.
Access control policy can limit unsafe privilege use but does not define safe actions for each privilege.
Access rights assignment can restrict privileges to intended actions, yet does not guarantee the privilege itself is safe.
Segregation of duties reduces risk of unsafe actions by splitting privileges but does not address unsafe privilege definitions.
Privileged access rights control can restrict unsafe privileges, yet does not ensure the privilege definition itself is safe.
Secure development lifecycle can catch unsafe privilege definitions during design but does not prevent them at runtime.
Hardening callouts derived
Configuration rules from DISA STIG baselines that reduce the attack surface for weaknesses of the type cited by this CVE. Derived transitively via CVE→CWE→STIG over `controls_xwalks` (authoritative rows only).
Ubuntu 22.04 (1 rule)
- V-260559 Ubuntu 22.04 LTS must ensure only users who need access to security functions are part of sudo group. via CWE-267
Ubuntu 24.04 (1 rule)
- V-270675 Ubuntu 24.04 LTS when booted must require authentication upon booting into single-user and maintenance modes. via CWE-267