An integer overflow vulnerability was found in the virtio-snd device via PCM_INFO requests from the guest. A malicious guest can provide out-of-bounds stream counts, potentially leading to unbounded memory allocation on the host and a denial of service condition.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemu | Jul 23, 2026 | Jul 23, 2026 |
| Suse | — | Upgrade qemu-docUpgrade qemu-extraUpgrade qemu-armUpgrade qemu-imgUpgrade qemu-pr-helperUpgrade qemu-audio-pipewireUpgrade qemu-langUpgrade qemu-ui-openglUpgrade qemu-block-nfsUpgrade qemu-vhost-user-gpuUpgrade qemuUpgrade qemu-audio-jackUpgrade qemu-s390xUpgrade qemu-ui-spice-appUpgrade qemu-block-rbdUpgrade qemu-chardev-spiceUpgrade qemu-skibootUpgrade qemu-ivshmem-toolsUpgrade qemu-audio-spiceUpgrade qemu-block-sshUpgrade qemu-chardev-baumUpgrade qemu-hw-display-qxlUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-spiceUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-ipxeUpgrade qemu-microvmUpgrade qemu-accel-tcg-x86Upgrade qemu-ui-spice-coreUpgrade qemu-block-dmgUpgrade qemu-block-curlUpgrade qemu-x86Upgrade qemu-SLOFUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-guest-agentUpgrade qemu-hw-usb-redirectUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-audio-alsaUpgrade qemu-audio-paUpgrade qemu-hw-usb-hostUpgrade qemu-accel-qtestUpgrade qemu-linux-userUpgrade qemu-audio-dbusUpgrade qemu-vgabiosUpgrade qemu-ui-cursesUpgrade qemu-ksmUpgrade qemu-block-iscsiUpgrade qemu-seabiosUpgrade qemu-headlessUpgrade qemu-hw-usb-smartcardUpgrade qemu-ui-gtkUpgrade qemu-ppcUpgrade qemu-vmsr-helperUpgrade qemu-toolsUpgrade qemu-audio-ossUpgrade qemu-ui-dbus | Apr 23, 2026 | Apr 20, 2026 |
| Ubuntu | — | Upgrade qemu-system-x86Upgrade qemu-systemUpgrade qemu-system-modules-openglUpgrade qemu-system-modules-spiceUpgrade qemu-system-dataUpgrade qemu-system-mipsUpgrade qemu-system-s390xUpgrade qemu-system-miscUpgrade qemu-system-xenUpgrade qemu-system-commonUpgrade qemu-system-riscvUpgrade qemu-system-guiUpgrade qemu-system-x86-xenUpgrade qemu-system-ppcUpgrade qemu-system-armUpgrade qemu-system-sparc | Apr 10, 2026 | Mar 3, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub