# CVE-2025-11234: QEMU use-after-free in VNC WebSocket handshake

Source: https://junglewise.ai/threats/cve-2025-11234-qemu-use-after-free-in-vnc-websocket-handshake  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-10-03. Updated: 2026-05-19  
License: CC BY 4.0 with a link back

CVE-2025-11234 · Severity: high · CVSS 7.5 · Published 2025-10-03

A vulnerability has been identified in QEMU, a widely used virtualization software that allows computers to run multiple operating systems simultaneously. A flaw in how the software handles remote desktop (VNC) connections via WebSockets can be exploited by a remote attacker to crash the virtual machine host. This results in a denial of service, potentially disrupting business operations and the availability of hosted services before a user even logs in.

Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2025-11234 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-11234 being exploited in the wild.

**How severe is CVE-2025-11234?** High severity, with a CVSS score of 7.5, published 3 October 2025.

**Which products and versions are affected?** Red Hat Qemu-Kvm Red Hat Enterprise Linux 9.4 Extended Update Support.

**Is there a fix for CVE-2025-11234?** A patch was published on 2025-12-16: Red Hat released security update RHSA-2025:23228 for qemu-kvm Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-11234 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2025-11234?** Check whether you run Red Hat Qemu-Kvm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use-after-free vulnerability exists in QEMU's QIOChannelWebsock component. The flaw occurs when a QIOChannelWebsock object is freed while a WebSocket handshake is still pending, resulting in a leaked GSource. When the handshake callback eventually fires, it attempts to access the already-freed channel object. A remote, unauthenticated attacker can trigger this condition by initiating a WebSocket handshake on the VNC port and causing the connection to close or time out in a specific manner. This leads to a crash of the QEMU process (Denial of Service). Patches have been released by Red Hat for various Enterprise Linux and OpenShift versions.

## Affected products

- QEMU QEMU versions prior to fix in 2025-10-03
- Red Hat qemu-kvm Red Hat Enterprise Linux 9.4 Extended Update Support
- Red Hat OpenShift Container Platform 4.16, 4.18

## Timeline

- 2025-10-03: disclosed: CVE-2025-11234 published
- 2025-12-16: patched: Red Hat released security update RHSA-2025:23228 for qemu-kvm
- 2026-01-15: patched: Red Hat released security updates RHSA-2026:0326 and RHSA-2026:0332 for OpenShift Container Platform

## References

- [https://access.redhat.com/errata/RHSA-2025:23228](https://access.redhat.com/errata/RHSA-2025:23228)
- [https://access.redhat.com/errata/RHSA-2026:0326](https://access.redhat.com/errata/RHSA-2026:0326)
- [https://access.redhat.com/errata/RHSA-2026:0332](https://access.redhat.com/errata/RHSA-2026:0332)
- [https://access.redhat.com/errata/RHSA-2026:0702](https://access.redhat.com/errata/RHSA-2026:0702)
- [https://access.redhat.com/errata/RHSA-2026:1831](https://access.redhat.com/errata/RHSA-2026:1831)
- [https://access.redhat.com/errata/RHSA-2026:18772](https://access.redhat.com/errata/RHSA-2026:18772)
- [https://access.redhat.com/errata/RHSA-2026:3077](https://access.redhat.com/errata/RHSA-2026:3077)