GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
oesa-2026-3844
Vulnerability from osv_openeuler
Published
2026-09-14 16:34
Modified
2026-09-14 16:34
Summary
qemu security update
Details

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.

Security Fix(es):

An unknown vulnerability exists in QEMU, with no detailed description available at this time.(CVE-2026-15264)

CVE-2026-18054 is a vulnerability in QEMU, details are not yet disclosed.(CVE-2026-18054)

This update to qemu-10.2.4-2.mga10 fixes 14 CVEs from 10.2.3 and 2 from 10.2.4(CVE-2026-3890)

This update to qemu-10.2.4-2.mga10 fixes 14 CVEs from 10.2.3 and 2 from 10.2.4. This vulnerability (CVE-2026-48004) is one of them.(CVE-2026-48004)

QEMU's virtio-rng frontend does not cancel or detach an RngRequest that is still pending on the rng-random backend before releasing the VirtIORNG object in virtio_rng_device_unrealize(). When a virtio-rng device is hot-plugged (device_del) and there are still entropy requests pending, the delayed backend completion calls the chr_read callback on the released object, causing the host heap to be use-after-free. An attacker able to trigger hot-plugging of the device could exploit this memory security flaw to compromise the QEMU process, causing a denial of service or potential code execution on the host.(CVE-2026-50624)

No detailed vulnerability information available.(CVE-2026-61402)

An unspecified vulnerability exists in QEMU, with no detailed information available at this time.(CVE-2026-61476)

CVE-2026-63109 is a vulnerability in QEMU. Details of this vulnerability have not been publicly disclosed yet.(CVE-2026-63109)

No detailed description available.(CVE-2026-63110)

An unknown vulnerability exists in QEMU, the details of which have not yet been disclosed. Attackers may exploit this vulnerability to cause unknown impacts.(CVE-2026-63320)

An unknown vulnerability exists in QEMU, the details of which have not yet been disclosed. Attackers may exploit this vulnerability to cause unknown impacts.(CVE-2026-63321)

When QEMU's uefi-vars-x64 virtual device processes the VarCheckPolicy REGISTER command, the uefi_vars_mm_check_policy_register() function directly reads pe->size without first verifying whether the request length contains the complete variable_policy_entry header. The guest can send a REGISTER request with a length of exactly sizeof(mm_check_policy) (excluding variable_policy_entry), causing the func pointer to cross the end of the allocated MM communication buffer, causing the host heap buffer to read out of bounds (heap-buffer-overflow). An attacker could exploit this memory security flaw to compromise the QEMU process, causing a denial of service or potential code execution on the host.(CVE-2026-63322)

An undisclosed vulnerability exists in QEMU, the details of which are not yet publicly available.(CVE-2026-63323)

An unknown type vulnerability exists in QEMU (Quick Emulator). The specific details have not been disclosed yet.(CVE-2026-65928)

CVE-2026-65929 is a security vulnerability affecting QEMU, with no detailed technical information disclosed yet.(CVE-2026-65929)

An unspecified vulnerability exists in QEMU, the details of which have not been disclosed.(CVE-2026-66022)

QEMU's VNC extended clipboard handler, after decompressing a client-controlled clipboard payload, compares the declared text size to the entire decompression buffer size, but then copies tsize bytes from buf + 4. The correct boundary is the remaining data length after the 4-byte length field. Therefore, a VNC client can cause QEMU to read up to 3 bytes out of bounds from the end of the decompressed heap buffer; a second VNC client can observe these bytes through the normal VNC extended clipboard PROVIDE path.(CVE-2026-8343)

Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
References
To clipboard 

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "qemu-8.2.0-61.oe2403sp1.aarch64.rpm",
          "qemu-block-curl-8.2.0-61.oe2403sp1.aarch64.rpm",
          "qemu-block-iscsi-8.2.0-61.oe2403sp1.aarch64.rpm",
          "qemu-block-rbd-8.2.0-61.oe2403sp1.aarch64.rpm",
          "qemu-block-ssh-8.2.0-61.oe2403sp1.aarch64.rpm",
          "qemu-debuginfo-8.2.0-61.oe2403sp1.aarch64.rpm",
          "qemu-debugsource-8.2.0-61.oe2403sp1.aarch64.rpm",
          "qemu-guest-agent-8.2.0-61.oe2403sp1.aarch64.rpm",
          "qemu-hw-usb-host-8.2.0-61.oe2403sp1.aarch64.rpm",
          "qemu-img-8.2.0-61.oe2403sp1.aarch64.rpm",
          "qemu-system-aarch64-8.2.0-61.oe2403sp1.aarch64.rpm",
          "qemu-system-arm-8.2.0-61.oe2403sp1.aarch64.rpm",
          "qemu-system-riscv-8.2.0-61.oe2403sp1.aarch64.rpm",
          "qemu-system-x86_64-8.2.0-61.oe2403sp1.aarch64.rpm",
          "qemu-user-8.2.0-61.oe2403sp1.aarch64.rpm",
          "qemu-user-binfmt-8.2.0-61.oe2403sp1.aarch64.rpm",
          "qemu-user-static-8.2.0-61.oe2403sp1.aarch64.rpm"
        ],
        "noarch": [
          "qemu-help-8.2.0-61.oe2403sp1.noarch.rpm"
        ],
        "src": [
          "qemu-8.2.0-61.oe2403sp1.src.rpm"
        ],
        "x86_64": [
          "qemu-8.2.0-61.oe2403sp1.x86_64.rpm",
          "qemu-block-curl-8.2.0-61.oe2403sp1.x86_64.rpm",
          "qemu-block-iscsi-8.2.0-61.oe2403sp1.x86_64.rpm",
          "qemu-block-rbd-8.2.0-61.oe2403sp1.x86_64.rpm",
          "qemu-block-ssh-8.2.0-61.oe2403sp1.x86_64.rpm",
          "qemu-debuginfo-8.2.0-61.oe2403sp1.x86_64.rpm",
          "qemu-debugsource-8.2.0-61.oe2403sp1.x86_64.rpm",
          "qemu-guest-agent-8.2.0-61.oe2403sp1.x86_64.rpm",
          "qemu-hw-usb-host-8.2.0-61.oe2403sp1.x86_64.rpm",
          "qemu-img-8.2.0-61.oe2403sp1.x86_64.rpm",
          "qemu-seabios-8.2.0-61.oe2403sp1.x86_64.rpm",
          "qemu-system-aarch64-8.2.0-61.oe2403sp1.x86_64.rpm",
          "qemu-system-arm-8.2.0-61.oe2403sp1.x86_64.rpm",
          "qemu-system-riscv-8.2.0-61.oe2403sp1.x86_64.rpm",
          "qemu-system-x86_64-8.2.0-61.oe2403sp1.x86_64.rpm",
          "qemu-user-8.2.0-61.oe2403sp1.x86_64.rpm",
          "qemu-user-binfmt-8.2.0-61.oe2403sp1.x86_64.rpm",
          "qemu-user-static-8.2.0-61.oe2403sp1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP1",
        "name": "qemu",
        "purl": "pkg:rpm/openEuler/qemu\u0026distro=openEuler-24.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.2.0-61.oe2403sp1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.\r\n\r\nSecurity Fix(es):\n\nAn unknown vulnerability exists in QEMU, with no detailed description available at this time.(CVE-2026-15264)\n\nCVE-2026-18054 is a vulnerability in QEMU, details are not yet disclosed.(CVE-2026-18054)\n\nThis update to qemu-10.2.4-2.mga10 fixes 14 CVEs from 10.2.3 and 2 from\n10.2.4(CVE-2026-3890)\n\nThis update to qemu-10.2.4-2.mga10 fixes 14 CVEs from 10.2.3 and 2 from 10.2.4. This vulnerability (CVE-2026-48004) is one of them.(CVE-2026-48004)\n\nQEMU\u0026amp;#39;s virtio-rng frontend does not cancel or detach an RngRequest that is still pending on the rng-random backend before releasing the VirtIORNG object in virtio_rng_device_unrealize(). When a virtio-rng device is hot-plugged (device_del) and there are still entropy requests pending, the delayed backend completion calls the chr_read callback on the released object, causing the host heap to be use-after-free. An attacker able to trigger hot-plugging of the device could exploit this memory security flaw to compromise the QEMU process, causing a denial of service or potential code execution on the host.(CVE-2026-50624)\n\nNo detailed vulnerability information available.(CVE-2026-61402)\n\nAn unspecified vulnerability exists in QEMU, with no detailed information available at this time.(CVE-2026-61476)\n\nCVE-2026-63109 is a vulnerability in QEMU. Details of this vulnerability have not been publicly disclosed yet.(CVE-2026-63109)\n\nNo detailed description available.(CVE-2026-63110)\n\nAn unknown vulnerability exists in QEMU, the details of which have not yet been disclosed. Attackers may exploit this vulnerability to cause unknown impacts.(CVE-2026-63320)\n\nAn unknown vulnerability exists in QEMU, the details of which have not yet been disclosed. Attackers may exploit this vulnerability to cause unknown impacts.(CVE-2026-63321)\n\nWhen QEMU\u0026amp;#39;s uefi-vars-x64 virtual device processes the VarCheckPolicy REGISTER command, the uefi_vars_mm_check_policy_register() function directly reads pe-\u0026gt;size without first verifying whether the request length contains the complete variable_policy_entry header. The guest can send a REGISTER request with a length of exactly sizeof(mm_check_policy) (excluding variable_policy_entry), causing the func pointer to cross the end of the allocated MM communication buffer, causing the host heap buffer to read out of bounds (heap-buffer-overflow). An attacker could exploit this memory security flaw to compromise the QEMU process, causing a denial of service or potential code execution on the host.(CVE-2026-63322)\n\nAn undisclosed vulnerability exists in QEMU, the details of which are not yet publicly available.(CVE-2026-63323)\n\nAn unknown type vulnerability exists in QEMU (Quick Emulator). The specific details have not been disclosed yet.(CVE-2026-65928)\n\nCVE-2026-65929 is a security vulnerability affecting QEMU, with no detailed technical information disclosed yet.(CVE-2026-65929)\n\nAn unspecified vulnerability exists in QEMU, the details of which have not been disclosed.(CVE-2026-66022)\n\nQEMU\u0026amp;#39;s VNC extended clipboard handler, after decompressing a client-controlled clipboard payload, compares the declared text size to the entire decompression buffer size, but then copies tsize bytes from buf + 4. The correct boundary is the remaining data length after the 4-byte length field. Therefore, a VNC client can cause QEMU to read up to 3 bytes out of bounds from the end of the decompressed heap buffer; a second VNC client can observe these bytes through the normal VNC extended clipboard PROVIDE path.(CVE-2026-8343)",
  "id": "OESA-2026-3844",
  "modified": "2026-09-14T16:34:55Z",
  "published": "2026-09-14T16:34:55Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3844"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15264"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18054"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3890"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48004"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50624"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61402"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61476"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63109"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63110"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63320"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63321"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63322"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63323"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65928"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65929"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66022"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8343"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "qemu security update",
  "upstream": [
    "CVE-2026-15264",
    "CVE-2026-18054",
    "CVE-2026-3890",
    "CVE-2026-48004",
    "CVE-2026-50624",
    "CVE-2026-61402",
    "CVE-2026-61476",
    "CVE-2026-63109",
    "CVE-2026-63110",
    "CVE-2026-63320",
    "CVE-2026-63321",
    "CVE-2026-63322",
    "CVE-2026-63323",
    "CVE-2026-65928",
    "CVE-2026-65929",
    "CVE-2026-66022",
    "CVE-2026-8343"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.