CVE-2025-54567 | Medium | 4.2 | 2025-07-25 | hw/pci/pcie_sriov.c in QEMU through 10.0.3 mishandles the VF Enable bit write mask, a related issue to CVE-2024-26327. |
CVE-2025-54566 | Medium | 4.2 | 2025-07-25 | hw/pci/pcie_sriov.c in QEMU through 10.0.3 has a migration state inconsistency, a related issue to CVE-2024-26327. |
CVE-2024-7730 | High | 7.4 | 2024-11-14 | A heap buffer overflow was found in the virtio-snd device in QEMU. When reading input audio in the virtio-snd input callback, virtio_snd_pcm_in_cb, the functio… |
CVE-2024-3447 | Medium | 6.0 | 2024-11-14 | A heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both `s->data_count` and the size of `s->fifo_buffer`… |
CVE-2024-6519 | High | 8.2 | 2024-10-21 | A use-after-free vulnerability was found in the QEMU LSI53C895A SCSI Host Bus Adapter emulation. This issue can lead to a crash or VM escape. |
CVE-2024-8354 | Medium | 5.5 | 2024-09-19 | A flaw was found in QEMU. An assertion failure was present in the usb_ep_get() function in hw/net/core.c when trying to get the USB endpoint from a USB device… |
CVE-2024-6505 | Medium | 6.8 | 2024-07-05 | A flaw was found in the virtio-net device in QEMU. When enabling the RSS feature on the virtio-net network card, the indirections_table data within RSS becomes… |
CVE-2024-3567 | Medium | 5.5 | 2024-04-10 | A flaw was found in QEMU. An assertion failure was present in the update_sctp_checksum() function in hw/net/net_tx_pkt.c when trying to calculate the checksum… |
CVE-2024-24474 | High | 8.8 | 2024-02-20 | QEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA transfer length is less than the length of… |
CVE-2024-26328 | Medium | 6.0 | 2024-02-19 | An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c does not set NumVFs to PCI_SRIOV_TOTAL_VF, and thus interaction with h… |
CVE-2024-26327 | Medium | 5.3 | 2024-02-19 | An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c mishandles the situation where a guest writes NumVFs greater than Tota… |
CVE-2023-6683 | Medium | 6.5 | 2024-01-12 | A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. The qemu_clipboard_request() function can be reached before vnc_serve… |
CVE-2023-6693 | Medium | 4.9 | 2024-01-02 | A stack based buffer overflow was found in the virtio-net device of QEMU. This issue occurs when flushing TX in the virtio_net_flush_tx function if guest featu… |
CVE-2023-2861 | Medium | 6.0 | 2023-12-06 | A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. The 9pfs server did not prohibit opening special files on the host side, poten… |
CVE-2023-5088 | Medium | 6.4 | 2023-11-03 | A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be targeted to offset 0 instead (potentially overwriting the… |
CVE-2023-3301 | Medium | 5.6 | 2023-09-13 | A flaw was found in QEMU. The async nature of hot-unplug enables a race scenario where the net device backend is cleared before the virtio-net pci frontend has… |
CVE-2023-3255 | Medium | 6.5 | 2023-09-13 | A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. A wrong exit condition may lead to an infinite loop when inflating an… |
CVE-2023-2680 | High | 7.5 | 2023-09-13 | This CVE exists because of an incomplete fix for CVE-2021-3750. More specifically, the qemu-kvm package as released for Red Hat Enterprise Linux 9.1 via RHSA-2… |
CVE-2023-42467 | Medium | 5.5 | 2023-09-11 | QEMU through 8.0.0 could trigger a division by zero in scsi_disk_reset in hw/scsi/scsi-disk.c because scsi_disk_emulate_mode_select does not prevent s->qdev.bl… |
CVE-2020-24165 | High | 8.8 | 2023-08-28 | An issue was discovered in TCG Accelerator in QEMU 4.2.0, allows local attackers to execute arbitrary code, escalate privileges, and cause a denial of service… |
CVE-2022-36648 | Critical | 10.0 | 2023-08-22 | The hardware emulation in the of_dpa_cmd_add_l2_flood of rocker device model in QEMU, as used in 7.0.0 and earlier, allows remote attackers to crash the host q… |
CVE-2023-40360 | Medium | 5.5 | 2023-08-14 | QEMU through 8.0.4 accesses a NULL pointer in nvme_directive_receive in hw/nvme/ctrl.c because there is no check for whether an endurance group is configured b… |
CVE-2023-4135 | Medium | 6.0 | 2023-08-04 | A heap out-of-bounds memory read flaw was found in the virtual nvme device in QEMU. The QEMU process does not validate an offset provided by the guest before c… |
CVE-2023-3180 | Medium | 6.0 | 2023-08-03 | A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests in virtio_crypto_handle_sym_req. There is no check for th… |
CVE-2023-3019 | Medium | 6.0 | 2023-07-24 | A DMA reentrancy issue leading to a use-after-free error was found in the e1000e NIC emulation code in QEMU. This issue could allow a privileged guest user to… |
CVE-2023-1386 | Low | 3.3 | 2023-07-24 | A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. When a local user in the guest writes an executable file with SUID or SGID, no… |
CVE-2023-3354 | High | 7.5 | 2023-07-11 | A flaw was found in the QEMU built-in VNC server. When a client connects to the VNC server, QEMU checks whether the current number of connections crosses a cer… |
CVE-2023-0664 | High | 7.8 | 2023-03-29 | A flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be able to manipulate the QEMU Guest Agent's Windows installer via… |
CVE-2023-1544 | Medium | 6.0 | 2023-03-23 | A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to allocate and initialize a huge numb… |
CVE-2023-0330 | Medium | 5.3 | 2023-03-06 | A vulnerability in the lsi53c895a device affects the latest version of qemu. A DMA-MMIO reentrancy problem may lead to memory corruption bugs like stack overfl… |
CVE-2022-4172 | Medium | 6.5 | 2022-11-29 | An integer overflow and buffer overflow issues were found in the ACPI Error Record Serialization Table (ERST) device of QEMU in the read_erst_record() and writ… |
CVE-2022-4144 | Medium | 6.5 | 2022-11-29 | An out-of-bounds read flaw was found in the QXL display device emulation in QEMU. The qxl_phys2virt() function does not check the size of the structure pointed… |
CVE-2022-3872 | High | 8.6 | 2022-11-07 | An off-by-one read/write issue was found in the SDHCI device of QEMU. It occurs when reading/writing the Buffer Data Port Register in sdhci_read_dataport and s… |
CVE-2022-3165 | Medium | 6.5 | 2022-10-17 | An integer underflow issue was found in the QEMU VNC server while processing ClientCutText messages in the extended format. A malicious client could use this f… |
CVE-2014-0148 | Medium | 5.5 | 2022-09-29 | Qemu before 2.0 block driver for Hyper-V VHDX Images is vulnerable to infinite loops and other potential issues when calculating BAT entries, due to missing bo… |
CVE-2014-0147 | Medium | 6.2 | 2022-09-29 | Qemu before 1.6.2 block diver for the various disk image formats used by Bochs and for the QCOW version 2 format, are vulnerable to a possible crash caused by… |
CVE-2014-0144 | High | 8.6 | 2022-09-29 | QEMU before 2.0.0 block drivers for CLOOP, QCOW2 version 2 and various other image formats are vulnerable to potential memory corruptions, integer/buffer overf… |
CVE-2022-2962 | High | 7.8 | 2022-09-13 | A DMA reentrancy issue was found in the Tulip device emulation in QEMU. When Tulip reads or writes to the rx/tx descriptor or copies the rx/tx frame, it doesn'… |
CVE-2022-0358 | High | 7.8 | 2022-08-29 | A flaw was found in the QEMU virtio-fs shared file system daemon (virtiofsd) implementation. This flaw is strictly related to CVE-2018-13405. A local guest use… |
CVE-2022-0216 | Medium | 4.4 | 2022-08-26 | A use-after-free vulnerability was found in the LSI53C895A SCSI Host Bus Adapter emulation of QEMU. The flaw occurs while processing repeated messages to cance… |
CVE-2021-3735 | Medium | 4.4 | 2022-08-26 | A deadlock issue was found in the AHCI controller device of QEMU. It occurs on a software reset (ahci_reset_port) while handling a host-to-device Register FIS… |
CVE-2021-3929 | High | 8.2 | 2022-08-25 | A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is similar to CVE-2021-3750 and, just like it, when the reent… |
CVE-2021-4158 | Medium | 6.0 | 2022-08-24 | A NULL pointer dereference issue was found in the ACPI code of QEMU. A malicious, privileged user within the guest could use this flaw to crash the QEMU proces… |
CVE-2020-14394 | Low | 3.2 | 2022-08-17 | An infinite loop flaw was found in the USB xHCI controller emulation of QEMU while computing the length of the Transfer Request Block (TRB) Ring. This flaw all… |
CVE-2022-35414 | High | 8.8 | 2022-07-11 | softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the translate_fail path, leading to an io_readx or io_writex crash. NOTE: a third… |
CVE-2021-3611 | Medium | 6.5 | 2022-05-11 | A stack overflow vulnerability was found in the Intel HD Audio device (intel-hda) of QEMU. A malicious guest could use this flaw to crash the QEMU process on t… |
CVE-2021-3750 | High | 8.2 | 2022-05-02 | A DMA reentrancy issue was found in the USB EHCI controller emulation of QEMU. EHCI does not verify if the Buffer Pointer overlaps with its MMIO region when it… |
CVE-2021-4207 | High | 8.2 | 2022-04-29 | A flaw was found in the QXL display device emulation in QEMU. A double fetch of guest controlled values `cursor->header.width` and `cursor->header.height` can… |
CVE-2021-4206 | High | 8.2 | 2022-04-29 | A flaw was found in the QXL display device emulation in QEMU. An integer overflow in the cursor_alloc() function can lead to the allocation of a small cursor o… |
CVE-2021-20295 | Medium | 6.5 | 2022-04-01 | It was discovered that the update for the virt:rhel module in the RHSA-2020:4676 (https://access.redhat.com/errata/RHSA-2020:4676) erratum released as part of… |
CVE-2022-1050 | High | 8.8 | 2022-03-29 | A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to execute HW commands when shared buf… |
CVE-2021-3582 | Medium | 6.5 | 2022-03-25 | A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. The issue occurs while handling a "PVRDMA_CMD_CREATE_MR" command due to improp… |
CVE-2021-3748 | High | 7.5 | 2022-03-23 | A use-after-free vulnerability was found in the virtio-net device of QEMU. It could occur when the descriptor's address belongs to the non direct access region… |
CVE-2022-26354 | Low | 3.2 | 2022-03-16 | A flaw was found in the vhost-vsock device of QEMU. In case of error, an invalid element was not detached from the virtqueue before freeing its memory, leading… |
CVE-2022-26353 | High | 7.5 | 2022-03-16 | A flaw was found in the virtio-net device of QEMU. This flaw was inadvertently introduced with the fix for CVE-2021-3748, which forgot to unmap the cached virt… |
CVE-2021-20257 | Medium | 6.5 | 2022-03-16 | An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx) descriptors in process_tx_desc if vari… |
CVE-2021-3638 | Medium | 6.5 | 2022-03-03 | An out-of-bounds memory access flaw was found in the ATI VGA device emulation of QEMU. This flaw occurs in the ati_2d_blt() routine while handling MMIO write o… |
CVE-2021-3608 | Medium | 6.0 | 2022-02-24 | A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions prior to 6.1.0. The issue occurs while handling a "PVRDMA_REG_DSRHI… |
CVE-2021-3607 | Medium | 6.0 | 2022-02-24 | An integer overflow was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions prior to 6.1.0. The issue occurs while handling a "PVR… |
CVE-2021-3947 | Medium | 5.5 | 2022-02-18 | A stack-buffer-overflow was found in QEMU in the NVME component. The flaw lies in nvme_changed_nslist() where a malicious guest controlling certain input can r… |
CVE-2021-3930 | Medium | 6.5 | 2022-02-18 | An off-by-one error was found in the SCSI device emulation in QEMU. It could occur while processing MODE SELECT commands in mode_sense_page() if the 'page' arg… |
CVE-2021-4145 | Medium | 6.5 | 2022-01-25 | A NULL pointer dereference issue was found in the block mirror layer of QEMU in versions prior to 6.2.0. The `self` pointer is dereferenced in mirror_wait_on_c… |
CVE-2021-3713 | High | 7.4 | 2021-08-25 | An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device uses the guest supplie… |
CVE-2021-3682 | High | 8.5 | 2021-08-05 | A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs when dropping packets during a bulk transfer from a S… |
CVE-2020-27661 | Medium | 6.5 | 2021-06-02 | A divide-by-zero issue was found in dwc2_handle_packet in hw/usb/hcd-dwc2.c in the hcd-dwc2 USB host controller emulation of QEMU. A malicious guest could use… |
CVE-2019-12067 | Medium | 6.5 | 2021-06-02 | The ahci_commit_buf function in ide/ahci.c in QEMU allows attackers to cause a denial of service (NULL dereference) when the command header 'ad->cur_cmd' is nu… |
CVE-2021-3546 | High | 8.2 | 2021-06-02 | An out-of-bounds write vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0. The flaw occur… |
CVE-2021-3545 | Medium | 6.5 | 2021-06-02 | An information disclosure vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0. The flaw ex… |
CVE-2021-3544 | Medium | 6.5 | 2021-06-02 | Several memory leaks were found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0. They exist in contrib/vhost-u… |
CVE-2020-35503 | Medium | 6.0 | 2021-06-02 | A NULL pointer dereference flaw was found in the megasas-gen2 SCSI host bus adapter emulation of QEMU in versions before and including 6.0. This issue occurs i… |
CVE-2013-4536 | High | 7.8 | 2021-05-28 | An user able to alter the savevm data (either on the disk or over the wire during migration) could use this flaw to to corrupt QEMU process memory on the (dest… |
CVE-2020-35506 | Medium | 6.7 | 2021-05-28 | A use-after-free vulnerability was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0 during the handling of the 'Informati… |
CVE-2020-35505 | Medium | 4.4 | 2021-05-28 | A NULL pointer dereference flaw was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0. This issue occurs while handling th… |
CVE-2020-35504 | Medium | 6.0 | 2021-05-28 | A NULL pointer dereference flaw was found in the SCSI emulation support of QEMU in versions before 6.0.0. This flaw allows a privileged guest user to crash the… |
CVE-2021-3527 | Medium | 5.5 | 2021-05-26 | A flaw was found in the USB redirector device (usb-redir) of QEMU. Small USB packets are combined into a single, large transfer request, to reduce the overhead… |
CVE-2021-20196 | Medium | 6.5 | 2021-05-26 | A NULL pointer dereference flaw was found in the floppy disk emulator of QEMU. This issue occurs while processing read/write ioport commands if the selected fl… |
CVE-2021-20221 | Medium | 6.0 | 2021-05-13 | An out-of-bounds heap buffer access issue was found in the ARM Generic Interrupt Controller emulator of QEMU up to and including qemu 4.2.0on aarch64 platform… |
CVE-2021-20181 | High | 7.5 | 2021-05-13 | A race condition flaw was found in the 9pfs server implementation of QEMU up to and including 5.2.0. This flaw allows a malicious 9p client to cause a use-afte… |
CVE-2021-3507 | Medium | 6.1 | 2021-05-06 | A heap buffer overflow was found in the floppy disk emulator of QEMU up to 6.0.0 (including). It could occur in fdctrl_transfer_handler() in hw/block/fdc.c whi… |
CVE-2021-3409 | Medium | 5.7 | 2021-03-23 | The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective, thus making QEMU vulnerable to the out-of-bounds read/write access issues previously f… |
CVE-2021-3392 | Low | 3.2 | 2021-03-23 | A use-after-free flaw was found in the MegaRAID emulator of QEMU. This issue occurs while processing SCSI I/O requests in the case of an error mptsas_free_requ… |
CVE-2021-3416 | Medium | 6.0 | 2021-03-18 | A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU in versions up to and including 5.2.0. The issue occurs in loopba… |
CVE-2021-20255 | Medium | 5.5 | 2021-03-09 | A stack overflow via an infinite recursion vulnerability was found in the eepro100 i8255x device emulator of QEMU. This issue occurs while processing controlle… |
CVE-2021-20263 | Low | 3.3 | 2021-03-09 | A flaw was found in the virtio-fs shared file system daemon (virtiofsd) of QEMU. The new 'xattrmap' option may cause the 'security.capability' xattr in the gue… |
CVE-2021-20203 | Low | 3.2 | 2021-02-25 | An integer overflow issue was found in the vmxnet3 NIC emulator of the QEMU for versions up to v5.2.0. It may occur if a guest was to supply invalid values for… |
CVE-2020-17380 | Medium | 6.3 | 2021-01-30 | A heap-based buffer overflow was found in QEMU through 5.0.0 in the SDHCI device emulation support. It could occur while doing a multi block SDMA transfer via… |
CVE-2020-35517 | High | 8.2 | 2021-01-28 | A flaw was found in qemu. A host privilege escalation issue was found in the virtio-fs shared file system daemon where a privileged guest user is able to creat… |
CVE-2020-29443 | Low | 3.9 | 2021-01-26 | ide_atapi_cmd_reply_end in hw/ide/atapi.c in QEMU 5.1.0 allows out-of-bounds read access because a buffer index is not validated. |
CVE-2020-11947 | Low | 3.8 | 2020-12-31 | iscsi_aio_ioctl_cb in block/iscsi.c in QEMU 4.1.0 has a heap-based buffer over-read that may disclose unrelated information from process memory to an attacker. |
CVE-2019-20808 | Medium | 6.5 | 2020-12-31 | In QEMU 4.1.0, an out-of-bounds read flaw was found in the ATI VGA implementation. It occurs in the ati_cursor_define() routine while handling MMIO write opera… |
CVE-2020-27821 | Medium | 6.0 | 2020-12-08 | A flaw was found in the memory management API of QEMU during the initialization of a memory region cache. This issue could lead to an out-of-bounds write acces… |
CVE-2020-28916 | Medium | 5.5 | 2020-12-04 | hw/net/e1000e_core.c in QEMU 5.0.0 has an infinite loop via an RX descriptor with a NULL buffer address. |
CVE-2020-25723 | Low | 3.2 | 2020-12-02 | A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while processing USB requests due to missing handling of DMA memor… |
CVE-2020-25624 | Medium | 5.0 | 2020-11-30 | hw/usb/hcd-ohci.c in QEMU 5.0.0 has a stack-based buffer over-read via values obtained from the host controller driver. |
CVE-2020-27617 | Medium | 6.5 | 2020-11-06 | eth_get_gso_type in net/eth.c in QEMU 4.2.1 allows guest OS users to trigger an assertion failure. A guest can crash the QEMU process via packet data that lack… |
CVE-2020-27616 | Medium | 6.5 | 2020-11-06 | ati_2d_blt in hw/display/ati_2d.c in QEMU 4.2.1 can encounter an outside-limits situation in a calculation. A guest can crash the QEMU process. |
CVE-2020-24352 | Medium | 5.5 | 2020-10-16 | An issue was discovered in QEMU through 5.1.0. An out-of-bounds memory access was found in the ATI VGA device implementation. This flaw occurs in the ati_2d_bl… |
CVE-2020-25743 | Low | 3.2 | 2020-10-06 | hw/ide/pci.c in QEMU before 5.1.1 can trigger a NULL pointer dereference because it lacks a pointer check before an ide_cancel_dma_sync call. |
CVE-2020-25742 | Low | 3.2 | 2020-10-06 | pci_change_irq_level in hw/pci/pci.c in QEMU before 5.1.1 has a NULL pointer dereference because pci_get_bus() might not return a valid pointer. |
CVE-2020-25741 | Low | 3.2 | 2020-10-02 | fdctrl_write_data in hw/block/fdc.c in QEMU 5.0.0 has a NULL pointer dereference via a NULL block pointer for the current drive. |