CVE-2008-3431: Oracle VirtualBox Insufficient Input Validation Vulnerability

High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2022-03-03. EPSS: 6.9% chance of exploitation in the next 30 days.

The VBoxDrvNtDeviceControl function in VBoxDrv.sys in Sun xVM VirtualBox before 1.6.4 uses the METHOD_NEITHER communication method for IOCTLs and does not properly validate a buffer associated with the Irp object, which allows local users to gain privileges by opening the \\.\VBoxDrv device and calling DeviceIoControl to send a crafted kernel address.

Affected products

• Oracle VirtualBox: before 1.6.4 (fixed in 1.6.4)

Published 2008-08-05. Last modified 2026-06-16.