mohabars/cve-2026-21986-virtualbox-dosCVE-2026-21986: VirtualBox Shared Folders kernel memory exhaustion DoS
This repository contains a proof of concept and technical write-up for CVE-2026-21986, a denial-of-service vulnerability in Oracle VM VirtualBox.
The issue exists in the Shared Folders driver interface and allows repeated triggering of kernel memory allocations through a device IOCTL interface. This can lead to exhaustion of non-paged kernel memory and result in a virtual machine freeze.
The vulnerability has been assigned CVE-2026-21986 with a CVSS score of 7.1 and has been patched by Oracle.
VirtualBox Shared Folders kernel driver interface (VBoxMiniRdr)
Repeated IOCTL calls with crafted input buffers result in uncontrolled allocation of kernel non-paged memory. Under sustained usage, this leads to resource exhaustion and VM instability or freeze.
No code execution or privilege escalation was observed.
The vulnerability is triggered through IOCTL_MRX_VBOX_ADDCONN, which processes user-controlled input buffers and results in kernel memory allocations proportional to the input size. Under repeated calls, allocations accumulate faster than they are released, leading to exhaustion of non-paged pool memory.
exploit/ poc.cpp
writeup/ technical_writeup.md memory_analysis.md
This vulnerability (CVE-2026-21986) was discovered and responsibly disclosed by Mohammed Ba Rashed, author of this repository, and is publicly acknowledged in Oracle’s security advisory and patch documentation.
This project is for educational and research purposes only. The vulnerability has been patched by Oracle. The author does not encourage or support misuse of this information.
