CVE-2026-77178

CVSS 9.1 (critical) · published 2026-10-06

Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bounds write in the host OS in pcnetReceiveNoSync in DevPCNet.cpp in the PCNet (Am79C970A) network device model.

Weakness: CWE-787

Source: NVD CVE-2026-77178

References

• https://gist.github.com/entropy1337/cd0d5b368445d20c43aca2590b313892
• https://www.oracle.com/
• https://www.virtualbox.org/wiki/Download_Old_Builds_7_0

Check your software

Connect an AI agent to the Fixlane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.