Junglewise Threat Intelligence

CVE-2025-11234: QEMU use-after-free in VNC WebSocket handshake

CVE-2025-11234 · Severity: high · CVSS 7.5 · Published 2025-10-03

Technologies: Qemu, Red Hat OpenShift Container Platform. Vendors: Qemu, Red Hat.

Executive brief

A vulnerability has been identified in QEMU, a widely used virtualization software that allows computers to run multiple operating systems simultaneously. A flaw in how the software handles remote desktop (VNC) connections via WebSockets can be exploited by a remote attacker to crash the virtual machine host. This results in a denial of service, potentially disrupting business operations and the availability of hosted services before a user even logs in.

Technical details

A use-after-free vulnerability exists in QEMU's QIOChannelWebsock component. The flaw occurs when a QIOChannelWebsock object is freed while a WebSocket handshake is still pending, resulting in a leaked GSource. When the handshake callback eventually fires, it attempts to access the already-freed channel object. A remote, unauthenticated attacker can trigger this condition by initiating a WebSocket handshake on the VNC port and causing the connection to close or time out in a specific manner. This leads to a crash of the QEMU process (Denial of Service). Patches have been released by Red Hat for various Enterprise Linux and OpenShift versions.

Affected products

  • QEMU QEMU versions prior to fix in 2025-10-03
  • Red Hat qemu-kvm Red Hat Enterprise Linux 9.4 Extended Update Support
  • Red Hat OpenShift Container Platform 4.16, 4.18

Timeline

  • 2025-10-03: disclosed: CVE-2025-11234 published
  • 2025-12-16: patched: Red Hat released security update RHSA-2025:23228 for qemu-kvm
  • 2026-01-15: patched: Red Hat released security updates RHSA-2026:0326 and RHSA-2026:0332 for OpenShift Container Platform

References