CVE-2020-2742

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)....

8.2 High

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.36, prior to 6.0.16 and prior to 6.1.2. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.64%Down 0.4 points since Apr 14, 2021

What each source reports

CVE List Score used 8.2

Record: CVE-2020-2742
CVSS 3.0: 8.2 HighCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

EUVDEUVD-2020-22535 8.2

Record: EUVD-2020-22535
CVSS 3.0: 8.2 HighCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-03

GitHub AdvisoriesGHSA-r45r-rg9j-7g74 No score

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)....

Record: GHSA-r45r-rg9j-7g74
Weakness: CWE-190
Updated: 2026-11-02

NVD 8.2

Record: CVE-2020-2742
CVSS 3.1: 8.2 HighCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS 3.0: 8.2 HighCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS 2.0: 4.6 MediumAV:L/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-190
Updated: 2026-11-02

OSVUBUNTU-CVE-2020-2742 8.2

Record: UBUNTU-CVE-2020-2742
CVSS 3.1: 8.2 HighCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS 3.0: 8.2 HighCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

OSVopenSUSE-SU-2020:0925-1 No score

Security update for Virtualbox

Virtualbox was updated to 6.0.22 (released May 15 2020 by Oracle)

This is a maintenance release. The following items were fixed and/or added:

Guest Additions: Build problems fix with Oracle Linux 8.2 (Red Hat compatible kernel) / Red Hat Enterprise Linux 8.2 / CentOS 8.2 (bug #19391) Guest Control/VBoxManage: fix handling of multiple environment variables supplied to 'VBoxManage guestcontrol VM run' (6.1.6/6.0.20 regression; bug #19518)

Version bump to 6.0.20 (released April 14 2020 by Oracle)

This is a maintenance release. The following items were fixed and/or added:

USB: Multiple enhancements improving prformance and stability
VBoxManage: Multiple fixes for guestcontrol command
Graphics: Enhancements in 2D and 3D acceleration and rendering
API: Fix for exception handling bug in Python bindings
Linux host and guest: Support Linux kernel 5.6 (bug #19312)

This update fixes the following security issues: CVE-2020-2741, CVE-2020-2742, CVE-2020-2743, CVE-2020-2748, CVE-2020-2758, CVE-2020-2894, CVE-2020-2902, CVE-2020-2905, CVE-2020-2907, CVE-2020-2908, CVE-2020-2909, CVE-2020-2910, CVE-2020-2911, CVE-2020-2913, CVE-2020-2914, CVE-2020-2929, CVE-2020-2951, CVE-2020-2958, CVE-2020-2959 (bsc#1169628)

Record: openSUSE-SU-2020:0925-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`virtualbox` Ubuntu:16.04:LTS	All versions, plus listed versions 5.0.4-dfsg-25.0.8-dfsg-15.0.10-dfsg-15.0.10-dfsg-25.0.10-dfsg-3 Show 25 moreShow less 5.0.10-dfsg-45.0.10-dfsg-55.0.10-dfsg-65.0.10-dfsg-75.0.12-dfsg-15.0.12-dfsg-25.0.14-dfsg-15.0.14-dfsg-25.0.14-dfsg-2build15.0.16-dfsg-25.0.16-dfsg-35.0.18-dfsg-15.0.18-dfsg-1ubuntu15.0.18-dfsg-25.0.18-dfsg-2build15.0.18-dfsg-2ubuntu15.0.24-dfsg-0ubuntu1.16.04.15.0.32-dfsg-0ubuntu1.16.04.25.0.36-dfsg-0ubuntu1.16.04.25.0.40-dfsg-0ubuntu1.16.04.15.0.40-dfsg-0ubuntu1.16.04.25.1.34-dfsg-0ubuntu1.16.04.25.1.38-dfsg-0ubuntu1.16.04.15.1.38-dfsg-0ubuntu1.16.04.25.1.38-dfsg-0ubuntu1.16.04.3	None known
`virtualbox` Ubuntu:18.04:LTS	All versions, plus listed versions 5.1.30-dfsg-15.2.0-dfsg-1build25.2.0-dfsg-25.2.0-dfsg-45.2.0-dfsg-5 Show 26 moreShow less 5.2.2-dfsg-25.2.2-dfsg-3~build15.2.2-dfsg-35.2.4-dfsg-15.2.4-dfsg-25.2.6-dfsg-15.2.6-dfsg-25.2.6-dfsg-35.2.6-dfsg-3build15.2.6-dfsg-55.2.8-dfsg-25.2.8-dfsg-35.2.8-dfsg-55.2.8-dfsg-65.2.8-dfsg-75.2.10-dfsg-15.2.10-dfsg-25.2.10-dfsg-55.2.10-dfsg-65.2.10-dfsg-6ubuntu18.04.15.2.18-dfsg-2~ubuntu18.04.15.2.18-dfsg-2~ubuntu18.04.35.2.18-dfsg-2~ubuntu18.04.55.2.32-dfsg-0~ubuntu18.04.15.2.34-dfsg-0~ubuntu18.04.15.2.42-dfsg-0~ubuntu1.18.04.1	None known
`virtualbox` openSUSE:Leap 15.1 From an advisory covering 19 CVEs	before 6.0.22-lp151.2.15.1	6.0.22-lp151.2.15.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-2742 is a high vulnerability (CVSS 8.2) in Oracle Vm Virtualbox, published April 15, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.64%, the 50th percentile. No source names a fixed version.

References

Show 23 moreShow less