Octane found its second confirmed CVE in Oracle’s VirtualBox VM in under a month.
VirtualBox is often used to inspect or run untrusted software inside an isolated guest. But it parses attached disk and optical media on the host before the guest starts. Octane found this vulnerability – CVE-2026-71125 – in that host-side parsing layer, where a crafted CUE sheet can corrupt heap memory and crash the process before any guest code runs.
The first finding, CVE-2026-60161, appeared in Oracle's July 21 security release; this latest, CVE-2026-71125, followed on August 18, exactly 28 days later.
Oracle credited the same four Octane researchers for both: Giovanni Vignone, Paolo Gentry, Robert van Eijk, and Shubham Antil.
The Vulnerability At a Glance
- Product: Oracle VM VirtualBox
- Component: Virtual Disk library, CUE/BIN backend
- Function:
cueParseTrack() - Trigger: A crafted CUE sheet containing TRACK 00
- Oracle score: 6.1 Medium (CVSS 3.1)
- Proven impact: Heap corruption and repeatable process termination
One Missing Lower-Bound Check
CUE sheets number tracks from 01 through 99. VirtualBox's own error message states the valid range is 01 to 99, yet the parser enforces only the upper limit:
if (u64Track <= 99)
pRegion = &pThis->pRegionList->aRegions[u64Track - 1];
TRACK 00 passes. Subtracting 1 indexes one descriptor before the region array.
On the 64-bit builds we tested, the region array begins 8 bytes into its allocation. Each descriptor occupies 48 bytes. aRegions[-1] therefore starts 40 bytes before the allocation boundary. VirtualBox then writes the track's start LBA, block size, data form, and metadata fields through that pointer.
We tested the bug against Oracle's stock VBoxDDU.so. Our harness calls VDOpen directly, so all parsing still happens inside Oracle's library.
The first input starts with TRACK 00. No region list exists yet, so the invalid write lands near the null address. The process exits with SIGSEGV, status 139. The second input declares TRACK 01 before TRACK 00, causing VirtualBox to allocate a valid 56-byte region list; TRACK 00 then points before it. Valgrind reports five invalid write contexts around that allocation:
Invalid write of size 8
ERROR SUMMARY: 5 errors from 5 contexts
The INDEX timestamp controls the first out-of-bounds store. VirtualBox accepts two decimal digits for each of the minutes, seconds, and frames fields, capping the written LBA at 453,024. This range can corrupt adjacent heap state but cannot directly plant a useful userspace pointer under ASLR.
Our evidence shows a repeatable crash and five writes outside a heap allocation. Oracle's public assessment matches that evidence: its August 2026 Critical Patch Update assigns high availability impact, low integrity impact, and no confidentiality impact.
The Fix
VirtualBox should reject track numbers outside the valid range before allocating or indexing:
if (u64Track < 1 || u64Track > 99)
return error;
A second guard inside cueEnsureRegionListSize() would keep another caller from reaching the same bad state.
Oracle officially lists VirtualBox 7.2.14 as affected. We also reproduced the bug on 7.2.12.
If you run VirtualBox 7.2.14 or earlier, apply Oracle’s August 2026 security update. Until then, do not attach, open or probe untrusted CUE/BIN media.
Overflows and Underflows
CVE-2026-60161 was a heap overflow in VirtualBox’s VMDK parser. It checked a compressed length against the wrong buffer capacity.
CVE-2026-71125 is a heap underflow in the CUE parser. It fails to enforce the lower bound on a track number.
Together, they demonstrate what Octane's agentic analysis can surface inside mature, heavily reviewed open source codebases. We publish this technical evidence because the frontier of AI-native vulnerability discovery should be measured in confirmed, reproducible findings.
Octane integrates directly into CI, analyzes every PR, and delivers findings with diff-ready fixes before code reaches production.
If these bugs made it into VirtualBox, there’s a strong chance they could be in your codebase, too.
Book a call today to watch Octane find the vulnerabilities your other security tooling has missed.
Subscribe to our newsletter
