UBUNTU-CVE-2026-16457
virtio: Malformed packed descriptor livelocks the device at 100% host CPU (guest triggered DoS)
Publication Mise à jour
PatchFirst · Vulnérabilités récentes
Vulnérabilités de qemu · Page n° 3
Vulnérabilités publiées pour qemu au cours des 30 derniers jours : 14. Présentes dans le catalogue KEV : 0.
Vulnérabilités : 485
Qemu-kvm: vhost inflight migration vmstate integer type mismatch causes out-of-bounds access
A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size is stored as a uint64_t but read by the VMS_VBUFFER load path as a signed int32_t. On little-endian hosts, a crafted incoming migration state with bit 31 set causes the value to be interpreted as negative and then implicitly converted to a very large size_t, leading qemu_get_buffer() to copy migration-stream data beyond the bounds of the mmap-backed inflight region. This can result in a crash of the QEMU process or memory corruption. Exploitation requires control of the migration producer or write access to the migration c
Publication Mise à jourUBUNTU-CVE-2026-9238
[hw/9pfs: cap Treaddir allocation]
Publication Mise à jourUBUNTU-CVE-2026-8348
[hw/9pfs: add xattr FID limit to prevent memory exhaustion]
Publication Mise à jourUBUNTU-CVE-2026-63319
QEMU USB Redirect Infinite Loop / Divide-by-Zero via max_packet_size=0
Publication Mise à jourUBUNTU-CVE-2026-61475
VNC lossy refresh dirty bitmap OOB write at 2160p
Publication Mise à jourUBUNTU-CVE-2026-16043
QEMU xHCI Interrupter Register OOB Access (Non-Default Configuration)
Publication Mise à jourUBUNTU-CVE-2026-15705
usbredir: fix use-after-free on buffered bulk packet overflow
Publication Mise à jourUBUNTU-CVE-2026-15578
QEMU VNC Tight PNG channel-max truncation causes remote denial of service
Publication Mise à jourQemu-kvm: qemu-guest-agent: local privilege escalation via symlink attack in guest-ssh-add-authorized-keys
A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use (TOCTOU) file-symlink race. Successful exploitation allows the attacker to gain ownership of arbitrary root-owned files or directories, leading to root access. This vulnerability requires an external management layer (e.g., libvirt) to trigger the affected code path.
Publication Mise à jourQemu-kvm: hyperv/syndbg: missing mapped-length guard after cpu_physical_memory_map causes host oob write
A flaw was found in QEMU. This vulnerability allows a local attacker within a guest virtual machine to write data beyond its allocated memory. This occurs when cpu_physical_memory_map() returns a shorter length than expected, leading to an out-of-bounds write. Successful exploitation could result in unauthorized access to guest memory or corruption of heap-allocated objects, potentially causing information disclosure, data integrity issues, or a denial of service.
Publication Mise à jourUBUNTU-CVE-2026-8343
ui: fix validation of VNC extended clipboard data length
Publication Mise à jourUBUNTU-CVE-2026-6425
libvhost-user: fix buffer overflow in virtqueue_read_indirect_desc()
Publication Mise à jourUBUNTU-CVE-2026-48004
9pfs: fix missing rename lock in v9fs_co_readdir_many
Publication Mise à jourUBUNTU-CVE-2026-48003
ui/vnc: fix OOB read updating VNC update frequency stats
Publication Mise à jourUBUNTU-CVE-2026-48002
ui/vnc OOB writes
Publication Mise à jourQemu-kvm: heap buffer overflow in virtio-blk scsi request handling
A flaw was found in QEMU's virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors before writing data. A malicious guest with high privileges could exploit this vulnerability by submitting a malformed virtio-blk SCSI request, leading to an out-of-bounds write in the host heap memory and a potential denial of service (DoS) for the QEMU process.
Publication Mise à jourUBUNTU-CVE-2026-5763
[virtio-scsi request size mismatch]
Publication Mise à jourUBUNTU-CVE-2026-3890
[hcd-ohci: infinite loop]
Publication Mise à jourQemu-kvm: heap buffer out-of-bounds read in vmdk compressed grain parsing
A flaw was found in QEMU. A specially crafted VMDK image could trigger an out-of-bounds read vulnerability, potentially leading to a 12-byte leak of sensitive information or a denial of service condition (DoS).
Publication Mise à jour
Vérifiez votre serveur
Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.