Is CVE-2025-11234 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-11234 being exploited in the wild.

How severe is CVE-2025-11234?

High severity, with a CVSS score of 7.5, published 3 October 2025.

Which products and versions are affected?

Red Hat Qemu-Kvm Red Hat Enterprise Linux 9.4 Extended Update Support.

Is there a fix for CVE-2025-11234?

A patch was published on 2025-12-16: Red Hat released security update RHSA-2025:23228 for qemu-kvm Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-11234 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2025-11234?

Check whether you run Red Hat Qemu-Kvm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-11234: QEMU use-after-free in VNC WebSocket handshake

CVE-2025-11234 · Severity: high · CVSS 7.5 · Published 2025-10-03

A vulnerability has been identified in QEMU, a widely used virtualization software that allows computers to run multiple operating systems simultaneously. A flaw in how the software handles remote desktop (VNC) connections via WebSockets can be exploited by a remote attacker to crash the virtual machine host. This results in a denial of service, potentially disrupting business operations and the availability of hosted services before a user even logs in.

Vendors: Red Hat.

Quick answers

Is CVE-2025-11234 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-11234 being exploited in the wild.
How severe is CVE-2025-11234?: High severity, with a CVSS score of 7.5, published 3 October 2025.
Which products and versions are affected?: Red Hat Qemu-Kvm Red Hat Enterprise Linux 9.4 Extended Update Support.
Is there a fix for CVE-2025-11234?: A patch was published on 2025-12-16: Red Hat released security update RHSA-2025:23228 for qemu-kvm Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-11234 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2025-11234?: Check whether you run Red Hat Qemu-Kvm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A use-after-free vulnerability exists in QEMU's QIOChannelWebsock component. The flaw occurs when a QIOChannelWebsock object is freed while a WebSocket handshake is still pending, resulting in a leaked GSource. When the handshake callback eventually fires, it attempts to access the already-freed channel object. A remote, unauthenticated attacker can trigger this condition by initiating a WebSocket handshake on the VNC port and causing the connection to close or time out in a specific manner. This leads to a crash of the QEMU process (Denial of Service). Patches have been released by Red Hat for various Enterprise Linux and OpenShift versions.

Affected products

QEMU QEMU versions prior to fix in 2025-10-03
Red Hat qemu-kvm Red Hat Enterprise Linux 9.4 Extended Update Support
Red Hat OpenShift Container Platform 4.16, 4.18

Timeline

2025-10-03: disclosed: CVE-2025-11234 published
2025-12-16: patched: Red Hat released security update RHSA-2025:23228 for qemu-kvm
2026-01-15: patched: Red Hat released security updates RHSA-2026:0326 and RHSA-2026:0332 for OpenShift Container Platform

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.