CVE-2020-2678

CVE-2020-2678 is a difficult-to-exploit vulnerability in Oracle VM VirtualBox versions prior to 5.2.36, 6.0.16, and 6.1.2, specifically affecting the Core component. A low-privileged attacker with logon access to the VirtualBox infrastructure can compromise the system, leading to unauthorized creation, deletion, or modification of critical data, as well as limited unauthorized read access. With a CVSS 3.0 Base Score of 6.4 (Medium), the attack requires high complexity and local access, but can significantly impact data confidentiality and integrity across potentially additional products. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.