This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-77178 →
UBUNTU-CVE-2026-77178
Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bounds write in the host OS in pcnetReceiveNoSync in DevPCNet.cpp in the PC...
Original description
The description as published by the source.
Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bounds write in the host OS in pcnetReceiveNoSync in DevPCNet.cpp in the PCNet (Am79C970A) network device model.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Ubuntu:16.04:LTS
virtualbox
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:18.04:LTS
virtualbox
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:20.04:LTS
virtualbox
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:22.04:LTS
virtualbox
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:24.04:LTS
virtualbox
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.10
virtualbox
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.04:LTS
virtualbox
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
References
- report ubuntu.com
- report cve.org