qemu vulnerabilities · Page 3

UBUNTU-CVE-2026-15705

usbredir: fix use-after-free on buffered bulk packet overflow

• Update to 1:10.0.12+ds-0+deb13u1

UBUNTU-CVE-2026-15578

QEMU VNC Tight PNG channel-max truncation causes remote denial of service

• Update to 1:10.0.12+ds-0+deb13u1

Qemu-kvm: qemu-guest-agent: local privilege escalation via symlink attack in guest-ssh-add-authorized-keys

A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use (TOCTOU) file-symlink race. Successful exploitation allows the attacker to gain ownership of arbitrary root-owned files or directories, leading to root access. This vulnerability requires an external management layer (e.g., libvirt) to trigger the affected code path.

Qemu-kvm: hyperv/syndbg: missing mapped-length guard after cpu_physical_memory_map causes host oob write

A flaw was found in QEMU. This vulnerability allows a local attacker within a guest virtual machine to write data beyond its allocated memory. This occurs when cpu_physical_memory_map() returns a shorter length than expected, leading to an out-of-bounds write. Successful exploitation could result in unauthorized access to guest memory or corruption of heap-allocated objects, potentially causing information disclosure, data integrity issues, or a denial of service.

• Update to 1:10.0.10+ds-0+deb13u1

UBUNTU-CVE-2026-3886

[virtio-gpu: fix overflow check when allocating 2d image]

• Update to 1:10.0.10+ds-0+deb13u1

UBUNTU-CVE-2026-8343

ui: fix validation of VNC extended clipboard data length

• Update to 1:10.0.11+ds-0+deb13u1

UBUNTU-CVE-2026-6425

libvhost-user: fix buffer overflow in virtqueue_read_indirect_desc()

• Update to 1:10.0.11+ds-0+deb13u1

UBUNTU-CVE-2026-48915

hw/uefi: fix parse_hexstr

• Update to 1:10.0.11+ds-0+deb13u1

UBUNTU-CVE-2026-48004

9pfs: fix missing rename lock in v9fs_co_readdir_many

• Update to 1:10.0.11+ds-0+deb13u1

UBUNTU-CVE-2026-48003

ui/vnc: fix OOB read updating VNC update frequency stats

• Update to 1:10.0.11+ds-0+deb13u1

UBUNTU-CVE-2026-48002

ui/vnc OOB writes

• Update to 1:10.0.12+ds-0+deb13u1

Qemu-kvm: virtio-snd: heap buffer overflow in virtio_snd_pcm_in_cb (incomplete fix for cve-2024-7730)

A flaw was found in QEMU. When reading input audio in the virtio-snd device input callback, the `virtio_snd_pcm_in_cb` function did not check whether the iov could fit the data buffer, potentially leading to a heap out-of-bounds write. This issue exists due to an incomplete fix for CVE-2024-7730.

• Update to 1:10.0.10+ds-0+deb13u1

Qemu-kvm: virtio-snd: integer overflow leading to unbounded memory allocation

An integer overflow vulnerability was found in the virtio-snd device via PCM_INFO requests from the guest. A malicious guest can provide out-of-bounds stream counts, potentially leading to unbounded memory allocation on the host and a denial of service condition.

• Update to 1:10.0.10+ds-0+deb13u1

Qemu-kvm: heap buffer overflow in virtio-blk scsi request handling

A flaw was found in QEMU's virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors before writing data. A malicious guest with high privileges could exploit this vulnerability by submitting a malformed virtio-blk SCSI request, leading to an out-of-bounds write in the host heap memory and a potential denial of service (DoS) for the QEMU process.

• Update to 1:10.0.11+ds-0+deb13u1

UBUNTU-CVE-2026-8341

hw/uefi: check auth.hdr_length minimum size

• Update to 1:10.0.10+ds-0+deb13u1

UBUNTU-CVE-2026-41440

hw/uefi: avoid possibly unaligned variable_auth_2 struct field access

• Update to 1:10.0.10+ds-0+deb13u1

UBUNTU-CVE-2026-41439

hw/uefi: verify data size before accessing it in wrap_pkcs7

• Update to 1:10.0.10+ds-0+deb13u1

UBUNTU-CVE-2026-41438

hw/uefi: add name_size check to uefi_vars_mm_lock_variable()

• Update to 1:10.0.10+ds-0+deb13u1

UBUNTU-CVE-2026-41437

hw/uefi: fix ucs2 string helper functions

• Update to 1:10.0.10+ds-0+deb13u1

UBUNTU-CVE-2026-41436

hw/uefi: verify pio_xfer_offset before calculating buffer checksum

• Update to 1:10.0.10+ds-0+deb13u1