https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T04:29:13.821261+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-376048 EUVD-2026-376048 2026-10-03T04:29:13.896001+00:00 EUVD-2026-376048 https://cve.radiocsirt.org/vuln/fkie_cve-2026-93834 fkie_cve-2026-93834 2026-10-03T04:29:13.896035+00:00

A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal restrictions and escaping the shared directory boundary. This can lead to arbitrary host file read/write and code execution (VM escape) as the QEMU process user.

 https://cve.radiocsirt.org/vuln/ghsa-86c2-8qp8-q2vh GHSA-86c2-8qp8-q2vh 2026-10-03T04:29:13.896068+00:00

A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal restrictions and escaping the shared directory boundary. This can lead to arbitrary host file read/write and code execution (VM escape) as the QEMU process user.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-93834 msrc_CVE-2026-93834 — Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape 2026-10-03T04:29:13.896087+00:00 msrc_CVE-2026-93834 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-93834 UBUNTU-CVE-2026-93834 2026-10-03T04:29:13.896104+00:00

Affected: Ubuntu:Pro:14.04:LTS: qemu, Ubuntu:Pro:16.04:LTS: qemu, Ubuntu:Pro:18.04:LTS: qemu, Ubuntu:Pro:20.04:LTS: qemu, Ubuntu:22.04:LTS: qemu, Ubuntu:24.04:LTS: qemu, Ubuntu:26.04:LTS: qemu, Ubuntu:26.04:LTS: qemu-hwe

A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal restrictions and escaping the shared directory boundary. This can lead to arbitrary host file read/write and code execution (VM escape) as the QEMU process user.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3598 WID-SEC-W-2026-3598 — QEMU: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit Benutzerrechten 2026-10-03T04:29:13.896136+00:00

Ein lokaler Angreifer kann eine Schwachstelle in QEMU ausnutzen, um beliebigen Programmcode mit Benutzerrechten auszuführen, Sicherheitsmaßnahmen zu umgehen und Daten zu manipulieren oder offenzulegen.