Oracle VM VirtualBox: Out-of-bounds write in PCNet network device model
Summary
A flaw in the emulated PCNet (Am79C970A) network adapter of Oracle VM VirtualBox allows an out-of-bounds write in the host process. A malicious or compromised guest VM with access to this virtual NIC can corrupt adjacent device state on the host, which may lead to a guest-to-host escape. The CVSS score is 9.1 (Critical), but NVD has not yet analysed the CVE and the attack requires code execution inside a guest VM.
Affected
- VirtualBox before 7.2.8 according to the CVE description
- VulDB reports versions up to 7.2.7
- A third-party gist reports VirtualBox 7.0.x through 7.0.26; not confirmed by the vendor
- Only VMs configured with the PCNet (Am79C970A) adapter are relevant
Fixed in
- Upgrade to VirtualBox 7.2.8 or later (according to the CVE description and VulDB)
- Fixed status of the 7.0.x and 7.1.x branches: Unknown.
- Vendor advisory from Oracle: not verified.
Workaround
- Change the network adapter type of affected VMs from PCNet to another virtual NIC model, after testing
- Limit the use of untrusted guest workloads on shared hosts
- Official Oracle workaround: Unknown.
Exploitation
- No exploitation in the wild found in the sources.
- Not listed in CISA KEV according to the sources found.
- CISA SSVC: Exploitation none, Automatable yes, Technical Impact total.
- VulDB status and exploit information conflict.
- Public proof of concept: Unknown.
Our recommendation
- Inventory all VirtualBox installations and their versions, including those at customers.
- Upgrade anything below 7.2.8 to the latest 7.2.x release.
- Check whether VMs use the PCNet adapter and change it where it is not required.
- Restrict untrusted guest workloads to dedicated hosts.
- Recheck NVD and the CISA KEV catalogue in one week, because the NVD status is still pending.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record (Vulners NVD mirror) vulners.com
- VulDB entry vuldb.com
- Ubuntu security notice ubuntu.com
- Third-party gist with technical details gist.github.com
- VirtualBox old builds 7.0 (CVE reference) www.virtualbox.org
- Help Net Security: VirtualBox 7.2.8 released www.helpnetsecurity.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:26.
Original description (NVD)
Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bounds write in the host OS in pcnetReceiveNoSync in DevPCNet.cpp in the PCNet (Am79C970A) network device model.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.