This question already has an answer here:
I'd like to know how much the risk changes if I don't update the software on the guest OS in a VM (applications and the guest operating system itself), compared to the risk in case it's all kept up-to-date.
NOTE: The guest OS in the VM can potentially be used for any purpose, but in this case let's say the main purpose of a VM is to avoid infecting the host OS, and therefore the VM will be used to run untrusted applications, open untrusted files (pdf, doc, html, etc.), maybe visit untrusted websites, etc. So yeah, I'm not using a VM just to visit youtube, in that case the risk will probably be negligible in any case (whether the system is up-to-date or not). I'm thinking of VMs for more risky stuff.
I'm asking this question because I realized that it can be a pain to keep the software in a VM up-to-date, especially when you have several VMs, or when you only want to use disposable instances, or when you don't want the network to be available in VMs, or when you rely on snapshots (which will then be older and therefore out-of-date). I know that not keeping it up-to-date is likely to increase the risk, but I don't know how much, and for all I know the difference could even be negligible. It probably depends on the likelihood of escaping from a VM by exploiting a vulnerability in the VM itself without relying on any other vulnerability in the guest OS, compared to the probability that a vulnerability in the guest OS is needed in order to escape from the VM. So maybe only somebody with enough experience on VM vulnerabilities could be able to assess the likelihood of this risk.