Executive brief
QEMU is an open-source virtualization platform that allows organizations to run virtual machines on their infrastructure. A flaw in QEMU's handling of VMDK disk images could allow an attacker to craft a malicious disk image that, when processed, leaks up to 12 bytes of sensitive information from the host system or causes the virtual machine to crash, disrupting service availability.
Technical details
The vulnerability is an out-of-bounds read in QEMU's VMDK image parsing logic. When a specially crafted VMDK disk image is opened or processed by QEMU, the code reads beyond allocated buffer boundaries, resulting in either disclosure of 12 bytes of sensitive host memory or a denial of service via crash. The attack requires the attacker to either provide a malicious VMDK file to a victim or have the ability to place such a file where QEMU will open it. No authentication or special privileges are required to trigger the vulnerability once a malicious image is available. A patch is available and should be applied to affected QEMU installations.
Affected products
- QEMU QEMU <UNKNOWN>
Timeline
- 2026-02-19: disclosed