Executive brief
A security vulnerability has been identified in QEMU, a widely used open-source virtualization software that allows computers to run multiple operating systems simultaneously. The flaw exists in the virtual sound device component, where improper handling of audio input could allow a malicious user to crash the virtual machine or potentially gain unauthorized access to the underlying host system. This could lead to service disruptions or the exposure of sensitive data managed by the virtualization platform.
Technical details
A heap-based buffer overflow vulnerability exists in QEMU's virtio-snd device implementation. The root cause is located in the `virtio_snd_pcm_in_cb` function, which fails to verify if the I/O vector (iov) can accommodate the incoming data buffer during audio input processing. This flaw is an incomplete fix for a previous vulnerability (CVE-2024-7730). A local attacker can exploit this by providing specially crafted audio input to trigger an out-of-bounds write on the heap. Successful exploitation could lead to arbitrary code execution on the host or a crash of the QEMU process. Fixes have been committed to the upstream QEMU repository.
Affected products
- QEMU Project QEMU 8.2.0 to 10.2.1
- Red Hat Red Hat Enterprise Linux 10
- Red Hat Red Hat Enterprise Linux 6
- Red Hat Red Hat Enterprise Linux 7
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat OpenShift Container Platform 4
Timeline
- 2026-03-02: disclosed: Initial report in Red Hat Bugzilla
- 2026-06-19: advisory: CVE published by NVD and Fedora Project