Pedal to the Metal: Accelerating to the Host via VirtualBox VMSVGA
NiNi Chen, Wei Che Kao (Xiaobye)
OffensiveCon 2026 · Day 2 · Main Stage
In this compelling talk from OffensiveCon, DEVCORE security researchers NiNi Chen and Wei Che Kao (Xiaobai) pull back the curtain on a treasure trove of vulnerabilities discovered within VirtualBox's graphic virtualization component, specifically the **VMSVGA** (and its Windows counterpart, VBox SVGA). The researchers detail a total of 14 distinct security flaws, including use-after-free conditions, out-of-bounds accesses, and integer overflows, which collectively enable a robust virtual machine escape. Their work, initially aimed at preparing for the Pwn2Own competition, highlights the critical importance of secure graphic virtualization implementations in hypervisors.
AI review
DEVCORE drops 14 bugs in VirtualBox's VMSVGA stack, walks through the full exploit chain to host code execution on both Linux and Windows, and still finds three novel vulns after colliding with a team that already won Pwn2Own on the same target. This is the real thing: original bug-hunting, disciplined root-cause analysis, and a complete exploitation narrative from UAF primitive to calc.exe on the host.