Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 3.2.24, 4.0.26, 4.1.34, 4.2.26,…

published 2014-07-17 12 y ago modified 2026-06-17 4 mo ago also EUVD-2014-2513

cvss: 3.6; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 7.1%; EPSS 7.1% chance of exploitation in 30 days, percentile 94%
public exploits: 2; Metasploit, Exploit-DB

Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 3.2.24, 4.0.26, 4.1.34, 4.2.26, and 4.3.12 allows local users to affect integrity and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-2486.

Patch / fix

distros 1

virtualbox Ubuntu 14.04 LTS 4.3.34-dfsg-1+deb8u1ubuntu1.14.04.1

ubuntu advisories UBUNTU-CVE-2014-2477

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Timeline

2014-07-15 First public exploit (Metasploit exploit/windows/local/virtual_box_guest_additions)
2014-07-17 Published

Exploit prediction

7.14% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

Metasploit exploit/windows/local/virtual_box_guest_additions VirtualBox Guest Additions VBoxGuest.sys Privilege Escalation metasploit exploit, average rank, 2014-07-15
EDB-34333 Oracle VM VirtualBox Guest Additions 4.3.10r93012 - 'VBoxGuest.sys' Local Privilege Escalation (Metasploit) local, 2014-08-13

CVSS scores

assigned by	version	score	vector
NVD	2.0	3.6	AV:L/AC:L/Au:N/C:N/I:P/A:P

References

exploit-db.com /exploits/34333
exploit
oracle.com /technetwork/topics/security/cpujul2014-1972956.html
vendor-advisory
vmware.com /security/advisories/VMSA-2014-0012.html
securityfocus.com /archive/1/534161/100/0/threaded
mailing-list
seclists.org /fulldisclosure/2014/Dec/23
mailing-list
securityfocus.com /bid/68613
vdb-entry

Sources

CVE List CVE-2014-2477
NVD CVE-2014-2477

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary