Is CVE-2026-93834 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-93834 being exploited in the wild.

How severe is CVE-2026-93834?

High severity, with a CVSS score of 8.8, published 25 September 2026.

Which products and versions are affected?

QEMU versions with 9pfs subsystem support.

Is there a fix for CVE-2026-93834?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-93834 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-93834?

Check whether you run QEMU at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-93834: QEMU use-after-free in 9pfs subsystem with VM escape

CVE-2026-93834 · Severity: high · CVSS 8.8 · Published 2026-09-25

QEMU's file-sharing feature for virtual machines contains a race condition that allows a guest user to escape sandbox restrictions and access the host system's files. An attacker with guest access can read, modify, or delete arbitrary files on the host, or execute code with the privileges of the QEMU process—potentially compromising the entire system. This is a critical privilege escalation from guest to host.

Quick answers

Is CVE-2026-93834 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-93834 being exploited in the wild.
How severe is CVE-2026-93834?: High severity, with a CVSS score of 8.8, published 25 September 2026.
Which products and versions are affected?: QEMU versions with 9pfs subsystem support.
Is there a fix for CVE-2026-93834?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-93834 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-93834?: Check whether you run QEMU at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A use-after-free race condition exists in QEMU's 9pfs subsystem between the main thread and worker threads during concurrent Tlcreate and Twalk request processing. An unprivileged guest user can craft a malicious fid path with stale heap data to bypass directory traversal restrictions, escaping the shared directory boundary and achieving arbitrary host file read/write or code execution as the QEMU process user (CWE-416). Patches are expected; users should disable 9pfs/VirtFS filesystem sharing and use virtio-fs as an alternative.

Affected products

QEMU versions with 9pfs subsystem support

Timeline

2026-09-25: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.