# CVE-2026-3195: QEMU heap overflow in virtio-snd device

Source: https://junglewise.ai/threats/cve-2026-3195-qemu-heap-overflow-in-virtio-snd-device  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-19. Updated: 2026-06-21  
License: CC BY 4.0 with a link back

CVE-2026-3195 · Severity: high · CVSS 7.4 · Published 2026-06-19

A security vulnerability has been identified in QEMU, a widely used open-source virtualization software that allows computers to run multiple operating systems simultaneously. The flaw exists in the virtual sound device component, where improper handling of audio input could allow a malicious user to crash the virtual machine or potentially gain unauthorized access to the underlying host system. This could lead to service disruptions or the exposure of sensitive data managed by the virtualization platform.

Technologies: [Red Hat Enterprise Linux 10](https://junglewise.ai/threats/technologies/enterprise-linux-10), [Red Hat Enterprise Linux 6](https://junglewise.ai/threats/technologies/enterprise-linux-6), [Red Hat Enterprise Linux 7](https://junglewise.ai/threats/technologies/enterprise-linux-7), [Red Hat Enterprise Linux 8](https://junglewise.ai/threats/technologies/enterprise-linux-8), [Red Hat Enterprise Linux 9](https://junglewise.ai/threats/technologies/enterprise-linux-9), [Red Hat OpenShift Container Platform 4](https://junglewise.ai/threats/technologies/openshift-container-platform-4). Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-3195 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-3195 being exploited in the wild.

**How severe is CVE-2026-3195?** High severity, with a CVSS score of 7.4, published 19 June 2026.

**Which products and versions are affected?** QEMU Project QEMU 8.2.0 to 10.2.1; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; and 3 more.

**Is there a fix for CVE-2026-3195?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-3195 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-3195?** Check whether you run Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-based buffer overflow vulnerability exists in QEMU's virtio-snd device implementation. The root cause is located in the `virtio_snd_pcm_in_cb` function, which fails to verify if the I/O vector (iov) can accommodate the incoming data buffer during audio input processing. This flaw is an incomplete fix for a previous vulnerability (CVE-2024-7730). A local attacker can exploit this by providing specially crafted audio input to trigger an out-of-bounds write on the heap. Successful exploitation could lead to arbitrary code execution on the host or a crash of the QEMU process. Fixes have been committed to the upstream QEMU repository.

## Affected products

- QEMU Project QEMU 8.2.0 to 10.2.1
- Red Hat Red Hat Enterprise Linux 10
- Red Hat Red Hat Enterprise Linux 6
- Red Hat Red Hat Enterprise Linux 7
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat OpenShift Container Platform 4

## Timeline

- 2026-03-02: disclosed: Initial report in Red Hat Bugzilla
- 2026-06-19: advisory: CVE published by NVD and Fedora Project

## References

- [https://gitlab.com/qemu-project/qemu](https://gitlab.com/qemu-project/qemu)
- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-3195](https://access.redhat.com/security/cve/CVE-2026-3195)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2443817](https://bugzilla.redhat.com/show_bug.cgi?id=2443817)

## Related threats

- [Red Hat yggdrasil-worker-package-manager argument injection in APT backend](https://junglewise.ai/threats/cve-2026-18157-red-hat-yggdrasil-worker-package-manager-argument-injection-in)
- [Samba AD DC LDAP filter injection and ACL bypass in Compare requests](https://junglewise.ai/threats/cve-2026-58222-samba-ad-dc-ldap-filter-injection-and-acl-bypass-in-compare)
- [Samba KDC out-of-bounds read in kpasswd service](https://junglewise.ai/threats/cve-2026-58216-samba-kdc-out-of-bounds-read-in-kpasswd-service)
- [Samba internal DNS server denial of service via TKEY cache exhaustion](https://junglewise.ai/threats/cve-2026-58218-samba-internal-dns-server-denial-of-service-via-tkey-cache)
- [Red Hat PCP auth bypass in pmproxy /store endpoint](https://junglewise.ai/threats/cve-2026-16527-red-hat-pcp-auth-bypass-in-pmproxy-store-endpoint)