CVE-2026-77178

CriticalCVSS 9.1/10Last modified Oct 6, 2026

Description

Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bounds write in the host OS in pcnetReceiveNoSync in DevPCNet.cpp in the PCNet (Am79C970A) network device model.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 6, 2026
Last modified
Oct 6, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-771799.4On macOS, the virtio-fs host server used by Docker Sandboxes improperly follows symlinks when reopening an unlinked file from a stored path.CVE-2026-77186.3A vulnerability was identified in Totolink WA300 5.2cu.7112_B20190227. Impacted is the function setWebWlanIdx of the file /cgi-bin/cstecgi.cCVE-2026-771808.3When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGCVE-2026-771819.8Incorrect Authorization vulnerability in Apache Syncope. An administrator with ClientApp's update entitlement is unable to perform the reCVE-2026-771838.8The FooSales – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all veCVE-2026-771845.2In MongoDB Connector for BI, the description text of a collection's JSON schema validator is incorporated into the comment text of the DDL rCVE-2026-771859.1Authentication bypass in sshd-core in Apache MINA SSHD versions 2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 for a certain (presumed rare) way tCVE-2026-771866.4The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fallback' Shortcode AttribCVE-2026-771876.4The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'before' and 'after' ShortcCVE-2026-771896.5The Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) plugin for WordPress is vulneCVE-2026-77199.8A security flaw has been discovered in Totolink WA300 5.2cu.7112_B20190227. The affected element is the function loginauth of the file /cgi-CVE-2026-771906.5On affected platforms running Arista EOS, an unauthenticated attacker who is network-adjacent to the switch and able to connect to a device