Executive brief
QEMU is an open-source virtualization software used to run virtual machines. A security flaw was found that allows a user inside a virtual machine to write data into memory areas they should not be able to access on the host system. This could lead to the virtual machine crashing, unauthorized access to sensitive data, or the corruption of system integrity.
Technical details
An out-of-bounds (OOB) write vulnerability exists in QEMU, specifically within the hyperv/syndbg component. The issue stems from a missing guard check after calling 'cpu_physical_memory_map()'. If this function returns a length shorter than requested, subsequent write operations using the original length will exceed the allocated buffer. This can result in an OOB write to guest memory or a heap-allocated MMIO bounce buffer. An attacker with local access to a guest VM can exploit this to cause memory corruption, potentially leading to a guest-to-host escape, information disclosure, or denial of service. An upstream fix has been identified in the QEMU GitLab repository.
Affected products
- QEMU Project QEMU 7.1.0 to 11.0.0
- Red Hat Red Hat Enterprise Linux 10 affected
- Red Hat Red Hat Enterprise Linux 6 affected
- Red Hat Red Hat Enterprise Linux 7 affected
- Red Hat Red Hat Enterprise Linux 8 affected
- Red Hat Red Hat Enterprise Linux 9 affected
- Red Hat Red Hat OpenShift Container Platform 4 affected
Timeline
- 2026-04-14: disclosed: Initial report in Red Hat Bugzilla
- 2026-07-15: advisory: NVD publication date