Quick answers
- Is CVE-2026-81627 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-81627 being exploited in the wild.
- How severe is CVE-2026-81627?
- High severity, with a CVSS score of 8.2, published 18 September 2026.
- Which products and versions are affected?
- Qemu <UNKNOWN>.
- Is there a fix for CVE-2026-81627?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-81627 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2026-81627?
- Check whether you run Qemu at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability exists in hw/i386/vapic.c, where the VAPIC setup hypercall fails to validate that a writable RAM alias remains within the option ROM window boundary. An attacker with guest root privileges on a Q35/KVM machine can invoke this hypercall to position the alias outside the expected range, causing it to overlap locked SMRAM regions and bypass the chipset D_LCK (SMRAM D-lock) protection mechanism. This out-of-bounds write (CWE-787) allows code injection directly into System Management Mode memory. The attack requires KVM acceleration and privileged guest access; exploitation is not possible on systems with VAPIC disabled or guests using x2APIC/MSR-based TPR access mechanisms. Patches are expected from the QEMU project.
Affected products
- QEMU QEMU <UNKNOWN>
Timeline
- 2026-09-18: disclosed