CVE-2025-53024

HIGH

Oracle VM VirtualBox 7.1.10 - Privilege Escalation in Core Component

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2025-53024. PoCs published by minq0x1412.

AI-analyzed exploit summary This repository contains a functional exploit for CVE-2025-53024, targeting VMware SVGA device. The exploit leverages an out-of-bounds write vulnerability to achieve arbitrary memory manipulation, leading to privilege escalation by overwriting critical structures and executing arbitrary code.

Description

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.1.10. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

Exploits (1)

github WORKING POC

by minq0x1412 · cpoc

https://github.com/minq0x1412/CVE-2025-53024

View Code ZIP pw:eip

This repository contains a functional exploit for CVE-2025-53024, targeting VMware SVGA device. The exploit leverages an out-of-bounds write vulnerability to achieve arbitrary memory manipulation, leading to privilege escalation by overwriting critical structures and executing arbitrary code.

Classification

Working Poc 95%

Attack Type

Lpe

Complexity

Complex

Reliability

Reliable

Target: VMware SVGA device (likely affecting VMware Workstation/Player)

No auth needed

Prerequisites: root access for PCI device interaction · VMware SVGA device present in the system

MITRE ATT&CK

T1068 - Exploitation for Privilege Escalation T1548 - Abuse Elevation Control Mechanism

mistral-large-3 · analyzed Jun 14, 2026 Full analysis →

References (1)

Core 1

Core References

Vendor Advisory vendor-advisory

https://www.oracle.com/security-alerts/cpujul2025.html

Scores

CVSS v3 8.2

EPSS 0.0024

EPSS Percentile 14.8%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-269

Status published

Products (1)

oracle/vm_virtualbox 7.1.10

Published Jul 15, 2025

Tracked Since Feb 18, 2026