CVE-2017-10129

HIGH

Oracle VM VirtualBox < 5.1.24 - Authenticated Remote Code Execution

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2017-10129. PoCs published by Google Security Research.

AI-analyzed exploit summary This exploit bypasses VirtualBox's process hardening by leveraging Windows' handling of image sections and UNC paths to load an arbitrary DLL into a protected VirtualBox process, achieving local privilege escalation. The PoC uses a directory symlink and SMB share manipulation to deceive the hardening checks.

Description

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is Prior to 5.1.24. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

Exploits (1)

exploitdb WORKING POC VERIFIED
by Google Security Research · textlocalwindows
https://www.exploit-db.com/exploits/42426

This exploit bypasses VirtualBox's process hardening by leveraging Windows' handling of image sections and UNC paths to load an arbitrary DLL into a protected VirtualBox process, achieving local privilege escalation. The PoC uses a directory symlink and SMB share manipulation to deceive the hardening checks.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: VirtualBox v5.1.22 r115126 x64
No auth needed
Prerequisites: Local access to the target system · VirtualBox installed · Ability to create directory symlinks · Access to SMB shares
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/99638
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1038929
Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/42426/

Scores

CVSS v3 8.8
EPSS 0.0164
EPSS Percentile 73.3%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

Status published
Products (2)
oracle/vm_virtualbox < 5.1.22
Oracle Corporation/Oracle VM VirtualBox unspecified - 5.1.24
Published Aug 08, 2017
Tracked Since Feb 18, 2026