CVE-2025-62641

HighCVSS 8.2/10Last modified Oct 8, 2026

Description

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.12 and 7.2.2. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-267

Affected software

No affected versions have been published.

Timeline

Published
Oct 21, 2025
Last modified
Oct 8, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-626428.6The Restaurant Brands International (RBI) assistant platform through 2025-09-06 has an "Anyone Can Join This Party" signup API that does notCVE-2025-626438.6The Restaurant Brands International (RBI) assistant platform through 2025-09-06 transmits passwords of user accounts in cleartext e-mail mesCVE-2025-626447.7The Restaurant Brands International (RBI) assistant platform through 2025-09-06 has a Global Store Directory that shares personal informatioCVE-2025-626459.9The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows a remote authenticated attacker to obtain a token witCVE-2025-626467.7The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows remote attackers to review the stored audio of converCVE-2025-626475.8The Restaurant Brands International (RBI) assistant platform through 2025-09-06 provides the functionality of returning a JWT that can be usCVE-2025-626485.8The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows remote attackers to adjust Drive Thru speaker audio vCVE-2025-626495.8The Restaurant Brands International (RBI) assistant platform through 2025-09-06 relies on client-side authentication for submission of equipCVE-2025-62657.2A path traversal vulnerability in the file_upload-cgi CGI program of Zyxel NWA50AX PRO firmware version 7.10(ACGE.2) and earlier could allowCVE-2025-626509.9The Restaurant Brands International (RBI) assistant platform through 2025-09-06 relies on client-side authentication for use of the diagnostCVE-2025-626515.8The Restaurant Brands International (RBI) assistant platform through 2025-09-06 does not implement access control for the bathroom rating inCVE-2025-626525.9Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaW
CVE-2025-62641: High severity, CVSS 8.2 | Vulnix