CVE-2025-62641

HIGH
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2025-62641 has a selected CVSS score of 8.2 (high); EIP currently links 1 repository PoC.

Description

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.12 and 7.2.2. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

Description source: GitHub Advisory

Exploitation context

Available material

Repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 23, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Oracle VM VirtualBox

Browse Oracle Corporation / Oracle VM VirtualBox
CVE List7.1.12affected
7.2.2affected

Proofs of concept

1

Repository PoCs

GitHubAl-Lord0x/CVE-2025-62641Repository PoCby Al-Lord0x0Exploit1 file

3.1 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that connects to a VirtualBox VRDP server and sends a crafted packet containing shellcode, intended to achieve remote code execution on the host.

Backdoor review

No backdoor observed in reviewed code

The supplied Python script is a proof-of-concept exploit for CVE-2025-62641 targeting Oracle VM VirtualBox. It constructs a malformed VRDP packet containing shellcode that connects back to an operator-configured IP and port. The code contains no concealed or materially misrepresented behavior that harms the operator or an unrelated system. The shellcode, network connection, and payload delivery are all consistent with the disclosed exploit and are under the operator's control via the CONFIG section.

ClassificationExploit
Model confidence95%
AuthenticationUnknown
Languagespython
Target softwareOracle VM VirtualBox
Attack typesremote code executionbuffer overflow
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively connects to a target and sends a payload designed to execute arbitrary code (shellcode) on the target system, which is the definition of an exploit.

CVE-2025-62641.py:2CVE-2025-62641.py:64-77

Requirements

  • Target must have VRDP enabled and accessible on the specified port.CVE-2025-62641.py:11-12
  • Attacker must set up a listener to receive the reverse shell connection.CVE-2025-62641.py:13-14

Observed behavior

  • Connects to a target host on a specified port via TCP.CVE-2025-62641.py:67-69
  • Constructs a packet with a VRDP magic header, a malformed CLIPBOARD_SYNC field, and a payload buffer containing shellcode.CVE-2025-62641.py:43-62
  • Sends the crafted packet to the target.CVE-2025-62641.py:71
  • The shellcode is a Windows x64 Meterpreter reverse TCP payload that connects back to the attacker's IP and port.CVE-2025-62641.py:17-18CVE-2025-62641.py:21-41
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Shellcode
x64 Windows Meterpreter Reverse TCP shellcode embedded in the scriptThe shellcode is the disclosed payload for the exploit. It connects back to the operator-configured ATTACKER_IP and ATTACKER_PORT.CVE-2025-62641.py:21-41
Network Connection
192.168.45.100:4444The operator-configured callback address for the reverse shell. The script uses these values to build the shellcode.CVE-2025-62641.py:13-14
Exploit Target
192.168.56.1:3389The target VirtualBox host's VRDP service, as configured by the operator.CVE-2025-62641.py:11-12
Review boundaries

What the analysis did not establish

  • The evidence is a single Python script; no build artifacts, dependencies, or execution environment are provided.
  • The script contains hardcoded IP addresses and ports that are unlikely to match a real target environment.
  • The shellcode is specific to Windows x64 and may not be compatible with the target host OS.
  • The script does not include any authentication or session establishment with the VRDP service before sending the exploit payload.
  • The review does not verify the exploit's effectiveness or the validity of the CVE association.
  • The shellcode is treated as a payload; its internal behavior (e.g., Meterpreter commands) is not analyzed beyond its network connection parameters.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

2