Is CVE-2026-3196 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-3196 being exploited in the wild.

How severe is CVE-2026-3196?

Medium severity, with a CVSS score of 5.5, published 19 June 2026.

Which products and versions are affected?

QEMU Project QEMU 8.2.0 to 10.2.1; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 9; Red Hat Red Hat Enterprise Linux 8.

Is there a fix for CVE-2026-3196?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-3196 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-3196?

Check whether you run Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8 or Red Hat Enterprise Linux 9. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-3196: QEMU virtio-snd integer overflow in PCM_INFO requests

CVE-2026-3196 · Severity: medium · CVSS 5.5 · Published 2026-06-19

A security vulnerability has been identified in QEMU, a widely used virtualization tool that allows computers to run multiple operating systems simultaneously. A malicious user within a virtual machine could exploit this flaw to crash the host system or exhaust its memory resources. This results in a denial of service, potentially disrupting other virtual machines and services running on the same physical hardware.

Technologies: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9. Vendors: Red Hat.

Quick answers

Is CVE-2026-3196 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-3196 being exploited in the wild.
How severe is CVE-2026-3196?: Medium severity, with a CVSS score of 5.5, published 19 June 2026.
Which products and versions are affected?: QEMU Project QEMU 8.2.0 to 10.2.1; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 9; Red Hat Red Hat Enterprise Linux 8.
Is there a fix for CVE-2026-3196?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-3196 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-3196?: Check whether you run Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8 or Red Hat Enterprise Linux 9. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An integer overflow vulnerability exists in the virtio-snd device component of QEMU during the processing of PCM_INFO requests. The flaw is triggered when a guest provides out-of-bounds stream counts, which leads to improper calculation of memory requirements. An attacker with local access to a guest virtual machine can exploit this to trigger unbounded memory allocation on the host system, resulting in a denial of service (DoS). The vulnerability is tracked as CWE-190 and affects QEMU versions 8.2.0 through 10.2.1. A fix has been committed to the upstream QEMU repository.

Affected products

QEMU Project QEMU 8.2.0 to 10.2.1
Red Hat Red Hat Enterprise Linux 10
Red Hat Red Hat Enterprise Linux 9
Red Hat Red Hat Enterprise Linux 8

Timeline

2026-03-02: disclosed: Initial report in Red Hat Bugzilla
2026-06-19: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.