Escaping the Guest: How Custom LLM Workflows Uncovered Critical VMSVGA Vulnerabilities

Cyera Research Labs used a custom LLM-driven code-tracing workflow to discover and weaponize an integer overflow in VirtualBox's VMSVGA vmsvgaR3RectCopy (CVE-2025-53024), demonstrating an out-of-bounds read/write allowing guest-to-host info leaks and vtable overwrites to achieve host code execution; the report details the failure modes of traditional tooling, the prompt-and-context engineering that produced the finding, a PoC exploit chain (leak → ASLR defeat → vtable overwrite → execution), and notes Oracle patched the issue by switching to 64-bit bounds arithmetic.