CriticalCritical vulnerability

CVE-2026-77178 (CVSS 9.1)

NVD · officialPublished Oct 6, 2026Risk 50/100

Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bounds write in the host OS in pcnetReceiveNoSync in DevPCNet.cpp in the PCNet (Am79C970A) network device model.

Technical details

CVSS

9.1

AV:NetworkAC:LowPR:NoneUI:NoneC:NoneI:HighA:High

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source