A flaw was found in QEMU. A specially crafted VMDK image could trigger an out-of-bounds read vulnerability, potentially leading to a 12-byte leak of sensitive information or a denial of service condition (DoS).
CVSS Details
- CVSS 3.1 Base Score: 5.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade qemu-system-aarch64-coreUpgrade qemu-ui-gtkUpgrade qemu-guest-agentUpgrade qemu-audio-alsaUpgrade qemu-block-curlUpgrade qemu-block-iscsiUpgrade qemu-system-x86-coreUpgrade qemu-block-sshUpgrade qemu-commonUpgrade qemu-userUpgrade qemu-block-rbdUpgrade ivshmem-toolsUpgrade qemu-block-nfsUpgrade qemu-audio-ossUpgrade qemu-kvm-coreUpgrade qemu-system-x86Upgrade qemu-audio-sdlUpgrade qemu-ui-sdlUpgrade qemu-user-staticUpgrade qemu-user-binfmtUpgrade qemu-system-aarch64Upgrade qemuUpgrade qemu-block-dmgUpgrade qemu-imgUpgrade qemu-debuginfoUpgrade qemu-ui-cursesUpgrade qemu-kvmUpgrade qemu-audio-pa | May 20, 2026 | May 20, 2026 |
| Debian | — | Upgrade qemu | Jul 23, 2026 | Jul 23, 2026 |
| Oracle_linux | — | Upgrade libguestfs-bash-completionUpgrade libvirt-daemon-driver-nodedevUpgrade libguestfs-xfsUpgrade libguestfs-javadocUpgrade libvirt-clientUpgrade libvirt-daemon-driver-qemuUpgrade hivexUpgrade ruby-hivexUpgrade nbdkit-develUpgrade lua-guestfsUpgrade libvirt-daemon-driver-networkUpgrade libvirt-daemon-driver-interfaceUpgrade libiscsi-develUpgrade supermin-develUpgrade nbdkit-basic-pluginsUpgrade libvirt-daemon-driver-storage-rbdUpgrade virt-v2v-bash-completionUpgrade seabiosUpgrade qemu-kvmUpgrade nbdkit-basic-filtersUpgrade netcf-develUpgrade nbdkit-tar-filterUpgrade ruby-libguestfsUpgrade python3-libguestfsUpgrade perl-Sys-GuestfsUpgrade virt-v2vUpgrade nbdkit-vddk-pluginUpgrade libguestfs-gfs2Upgrade swtpm-develUpgrade libvirtUpgrade libguestfs-winsupportUpgrade python3-libnbdUpgrade nbdkit-tar-pluginUpgrade libvirt-nssUpgrade libvirt-docsUpgrade libvirt-client-qemuUpgrade libguestfs-toolsUpgrade swtpm-toolsUpgrade seabios-binUpgrade libguestfs-gobject-develUpgrade qemu-kvm-coreUpgrade libvirt-daemon-kvmUpgrade libguestfs-gobjectUpgrade libvirt-daemon-driver-storage-glusterUpgrade libvirt-daemon-driver-secretUpgrade libguestfs-inspect-iconsUpgrade swtpm-tools-pkcs11Upgrade qemu-imgUpgrade qemu-kvm-commonUpgrade libguestfs-rescueUpgrade nbdkit-serverUpgrade nbdkit-python-pluginUpgrade libvirt-daemon-driver-storage-logicalUpgrade libvirt-daemon-driver-nwfilterUpgrade libtpmsUpgrade libguestfs-applianceUpgrade swtpm-libsUpgrade seavgabios-binUpgrade qemu-kvm-block-glusterUpgrade python3-libvirtUpgrade python3-hivexUpgrade perl-hivexUpgrade libguestfsUpgrade qemu-kvm-device-usb-hostUpgrade nbdkit-ssh-pluginUpgrade qemu-kvm-block-curlUpgrade libguestfs-javaUpgrade qemu-guest-agentUpgrade perl-Sys-VirtUpgrade libvirt-daemon-driver-storage-iscsi-directUpgrade nbdkit-curl-pluginUpgrade virt-v2v-man-pages-jaUpgrade qemu-kvm-block-iscsiUpgrade libvirt-daemonUpgrade libnbd-develUpgrade libguestfs-rsyncUpgrade hivex-develUpgrade libguestfs-java-develUpgrade nbdkit-gzip-pluginUpgrade libvirt-daemon-driver-storage-scsiUpgrade libvirt-daemon-config-networkUpgrade libiscsiUpgrade libguestfs-man-pages-jaUpgrade netcf-libsUpgrade qemu-kvm-block-rbdUpgrade virt-dibUpgrade sgabiosUpgrade nbdkit-tmpdisk-pluginUpgrade nbdkit-nbd-pluginUpgrade libvirt-dbusUpgrade libvirt-daemon-driver-storage-coreUpgrade nbdkit-bash-completionUpgrade libvirt-lock-sanlockUpgrade libvirt-daemon-driver-storage-iscsiUpgrade libnbdUpgrade libiscsi-utilsUpgrade libvirt-daemon-config-nwfilterUpgrade libnbd-bash-completionUpgrade libguestfs-man-pages-ukUpgrade netcfUpgrade nbdkitUpgrade libvirt-wiresharkUpgrade libvirt-libsUpgrade libvirt-daemon-driver-storage-diskUpgrade libtpms-develUpgrade libguestfs-develUpgrade virt-v2v-man-pages-ukUpgrade swtpmUpgrade nbdkit-gzip-filterUpgrade nbdkit-example-pluginsUpgrade libvirt-daemon-driver-storageUpgrade libvirt-develUpgrade libvirt-daemon-driver-storage-mpathUpgrade qemu-kvm-block-sshUpgrade sgabios-binUpgrade qemu-virtiofsdUpgrade nbdfuseUpgrade nbdkit-linuxdisk-pluginUpgrade libguestfs-tools-cUpgrade superminUpgrade nbdkit-xz-filter | Apr 28, 2026 | Feb 10, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Feb 10, 2026 |
| Suse | — | Upgrade qemu-x86Upgrade qemu-SLOFUpgrade qemu-ui-cursesUpgrade qemu-ksmUpgrade qemu-block-dmgUpgrade qemu-block-nfsUpgrade qemu-s390xUpgrade qemu-s390Upgrade qemu-vhost-user-gpuUpgrade qemu-spiceUpgrade qemu-audio-pipewireUpgrade qemu-kvmUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-accel-qtestUpgrade qemu-docUpgrade qemu-chardev-spiceUpgrade qemu-ui-dbusUpgrade qemu-imgUpgrade qemu-audio-spiceUpgrade qemu-ivshmem-toolsUpgrade qemu-ipxeUpgrade qemu-pr-helperUpgrade qemu-seabiosUpgrade qemu-audio-jackUpgrade qemu-extraUpgrade qemu-ui-openglUpgrade qemu-chardev-baumUpgrade qemu-ui-sdlUpgrade qemu-audio-sdlUpgrade qemu-sgabiosUpgrade qemu-ui-spice-appUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-hw-display-qxlUpgrade qemu-block-sshUpgrade qemu-accel-tcg-x86Upgrade qemu-toolsUpgrade qemu-hw-usb-smartcardUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-armUpgrade qemu-ui-spice-coreUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-block-iscsiUpgrade qemu-ui-gtkUpgrade qemu-hw-usb-hostUpgrade qemu-block-curlUpgrade qemuUpgrade qemu-vmsr-helperUpgrade qemu-microvmUpgrade qemu-headlessUpgrade qemu-langUpgrade qemu-linux-userUpgrade qemu-block-rbdUpgrade qemu-skibootUpgrade qemu-hw-usb-redirectUpgrade qemu-audio-dbusUpgrade qemu-ppcUpgrade qemu-audio-alsaUpgrade qemu-audio-paUpgrade qemu-guest-agentUpgrade qemu-vgabiosUpgrade qemu-audio-oss | Apr 23, 2026 | Apr 20, 2026 |
| Ubuntu | — | Upgrade qemu-system-common (Ubuntu Pro)Upgrade qemu-system-xenUpgrade qemu-systemUpgrade qemu-system-sparc (Ubuntu Pro)Upgrade qemu-system-x86Upgrade qemu-system-sparcUpgrade qemu-system-x86-microvm (Ubuntu Pro)Upgrade qemu-system-miscUpgrade qemu-system-mipsUpgrade qemu-system-x86-xen (Ubuntu Pro)Upgrade qemu-system-aarch64 (Ubuntu Pro)Upgrade qemu-kvm (Ubuntu Pro)Upgrade qemu-system-mips (Ubuntu Pro)Upgrade qemu-block-extra (Ubuntu Pro)Upgrade qemu-common (Ubuntu Pro)Upgrade qemu-system-gui (Ubuntu Pro)Upgrade qemu-system-x86 (Ubuntu Pro)Upgrade qemu-utils (Ubuntu Pro)Upgrade qemu-system-riscvUpgrade qemu-system-arm (Ubuntu Pro)Upgrade qemu-system-s390x (Ubuntu Pro)Upgrade qemu-user-static (Ubuntu Pro)Upgrade qemu-system-x86-xenUpgrade qemu-user-binfmt (Ubuntu Pro)Upgrade qemu-user (Ubuntu Pro)Upgrade qemu-system-modules-openglUpgrade qemu-keymaps (Ubuntu Pro)Upgrade qemu-system-guiUpgrade qemu-system-data (Ubuntu Pro)Upgrade qemu-system-s390xUpgrade qemu-system-dataUpgrade qemu-guest-agent (Ubuntu Pro)Upgrade qemu-system-misc (Ubuntu Pro)Upgrade qemu-system-armUpgrade qemu-system-ppc (Ubuntu Pro)Upgrade qemu-system-modules-spiceUpgrade qemuUpgrade qemu (Ubuntu Pro)Upgrade qemu-system-commonUpgrade qemu-system-x86-microvmUpgrade qemu-system-ppcUpgrade qemu-system (Ubuntu Pro) | Apr 10, 2026 | Feb 19, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub