Vulnerabilities
Oracle VirtualBox VirtioSCSI Uninitialized Memory Disclosure – CVE‑2026‑71132
A flaw in VirtualBox’s VirtioSCSI driver lets a local attacker with high‑privileged guest code read hypervisor data. Oracle has released a patch; defenders should update immediately and review guest privilege levels.
What happened
Oracle disclosed an uninitialized memory flaw in the VirtioSCSI device of VirtualBox that can leak hypervisor‑level data to a local attacker who already runs high‑privileged code inside a guest.
Impact
When triggered, the bug can expose sensitive information from the hypervisor context. The CVSS score is 5.3 (AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N). Only installations running affected VirtualBox versions are vulnerable.
What to do
- Apply Oracle’s security patch released on 9 Sep 2026 (see Oracle CSPU‑Aug‑2026).
- Verify that the VirtioSCSI driver is initialized before use; consider disabling the device if not needed.
- Monitor for any high‑privileged code execution inside guests and enforce least‑privilege policies.
- Update hypervisor and guest OS to latest versions to reduce attack surface.
Mitigation
Oracle recommends updating to the patched VirtualBox release; no work‑arounds are available for unpatched systems.
Related vulnerabilities
Chromium CVE-2026-95324: Uninitialized GPU Resource Vulnerability
A flaw in Chromium’s GPU handling allows an attacker to exploit an uninitialized resource, potentially leading to memory corruption or arbitrary code execution. Microsoft Edge, built on Chromium, incorporates the same fix, so updating to the latest Edge version mitigates the risk. Defenders should verify Edge is current and monitor GPU activity for anomalies.
Read briefing
CVE-2026-108462: Windows Kernel Information Disclosure Vulnerability
Microsoft has identified a Windows kernel information disclosure flaw (CVE‑2026‑108462) that permits local attackers with elevated privileges to read sensitive system data. The issue is fixed in the latest security update; administrators should apply the patch immediately and verify that kernel memory is protected.
Read briefing
CVE-2026-70077: Windows Kernel Use‑After‑Free Information Disclosure
Microsoft released a patch for CVE-2026-70077, a kernel‑level use‑after‑free flaw that lets local attackers read arbitrary memory. Affected Windows systems can expose sensitive data if an attacker gains local privileges. Defenders should apply the update immediately, audit local admin accounts, and monitor for anomalous memory access.
Read briefing
CVE‑2026‑83515: RPC Runtime Information Disclosure in Windows
Microsoft has disclosed an information‑disclosure flaw in the RPC Runtime that can be triggered by an unauthenticated network attacker. The vulnerability allows reading of uninitialized memory, potentially exposing sensitive data. Apply the latest security update and review RPC service exposure.
Read briefing