https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 05:04:29 +0000 https://cve.radiocsirt.org/vuln/alsa-2026:39311 <p><strong>Affected:</strong> AlmaLinux:9: qemu-guest-agent, AlmaLinux:9: qemu-img, AlmaLinux:9: qemu-kvm, AlmaLinux:9: qemu-kvm-audio-pa, AlmaLinux:9: qemu-kvm-block-blkio, AlmaLinux:9: qemu-kvm-block-curl, AlmaLinux:9: qemu-kvm-block-rbd, AlmaLinux:9: qemu-kvm-common, AlmaLinux:9: qemu-kvm-core, AlmaLinux:9: qemu-kvm-device-display-virtio-gpu and 10 more</p> <p>Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.</p> <p>Security Fix(es):</p> <p>* qemu-kvm: Heap buffer overflow in virtio-blk SCSI request handling (CVE-2026-48914)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:9: qemu-guest-agent, AlmaLinux:9: qemu-img, AlmaLinux:9: qemu-kvm, AlmaLinux:9: qemu-kvm-audio-pa, AlmaLinux:9: qemu-kvm-block-blkio, AlmaLinux:9: qemu-kvm-block-curl, AlmaLinux:9: qemu-kvm-block-rbd, AlmaLinux:9: qemu-kvm-common, AlmaLinux:9: qemu-kvm-core, AlmaLinux:9: qemu-kvm-device-display-virtio-gpu and 10 more</p> <p>Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.</p> <p>Security Fix(es):</p> <p>* qemu-kvm: Heap buffer overflow in virtio-blk SCSI request handling (CVE-2026-48914)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2026:39311 https://cve.radiocsirt.org/vuln/bell-cve-2026-48914 <p><strong>Affected:</strong> Alpaquita:25: qemu, Alpaquita:stream: qemu</p> <p><strong>Affected:</strong> Alpaquita:25: qemu, Alpaquita:stream: qemu</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-48914 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0783 certfr-2026-avi-0783 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0783 https://cve.radiocsirt.org/vuln/euvd-2026-361972 EUVD-2026-361972 https://cve.radiocsirt.org/vuln/euvd-2026-361972 https://cve.radiocsirt.org/vuln/fkie_cve-2026-48914 <p>A flaw was found in QEMU&#39;s virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors before writing data. A malicious guest with high privileges could exploit this vulnerability by submitting a malformed virtio-blk SCSI request, leading to an out-of-bounds write in the host heap memory and a potential denial of service (DoS) for the QEMU process.</p> <p>A flaw was found in QEMU&#39;s virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors before writing data. A malicious guest with high privileges could exploit this vulnerability by submitting a malformed virtio-blk SCSI request, leading to an out-of-bounds write in the host heap memory and a potential denial of service (DoS) for the QEMU process.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-48914 https://cve.radiocsirt.org/vuln/ghsa-4hmh-vx7h-h98p <p>A flaw was found in QEMU&#39;s virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors before writing data. A malicious guest with high privileges could exploit this vulnerability by submitting a malformed virtio-blk SCSI request, leading to an out-of-bounds write in the host heap memory and a potential denial of service (DoS) for the QEMU process.</p> <p>A flaw was found in QEMU&#39;s virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors before writing data. A malicious guest with high privileges could exploit this vulnerability by submitting a malformed virtio-blk SCSI request, leading to an out-of-bounds write in the host heap memory and a potential denial of service (DoS) for the QEMU process.</p> https://cve.radiocsirt.org/vuln/ghsa-4hmh-vx7h-h98p https://cve.radiocsirt.org/vuln/msrc_cve-2026-48914 msrc_CVE-2026-48914 https://cve.radiocsirt.org/vuln/msrc_cve-2026-48914 https://cve.radiocsirt.org/vuln/oesa-2026-2861 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP3: qemu</p> <p>QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed. Security Fix(es):</p> <p>A vulnerability, which was classified as critical, has been found in QEMU (Virtualization Software) (version unknown).Using CWE to declare the problem leads to CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control.Impacted is confidentiality, integrity, and availability.Upgrading eliminates this vulnerability.(CVE-2026-3886)</p> <p>A flaw was found in QEMU&amp;apos;s virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors before writing data. A malicious guest with high privileges could exploit this vulnerability by submitting a malformed virtio-blk SCSI request, leading to an out-of-bounds write in the host heap memory and a potential denial of service (DoS) for the QEMU process.(CVE-2026-48914)</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP3: qemu</p> <p>QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed. Security Fix(es):</p> <p>A vulnerability, which was classified as critical, has been found in QEMU (Virtualization Software) (version unknown).Using CWE to declare the problem leads to CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control.Impacted is confidentiality, integrity, and availability.Upgrading eliminates this vulnerability.(CVE-2026-3886)</p> <p>A flaw was found in QEMU&amp;apos;s virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors before writing data. A malicious guest with high privileges could exploit this vulnerability by submitting a malformed virtio-blk SCSI request, leading to an out-of-bounds write in the host heap memory and a potential denial of service (DoS) for the QEMU process.(CVE-2026-48914)</p> https://cve.radiocsirt.org/vuln/oesa-2026-2861 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11250-1 <p>qemu-11.0.2-1.1 on GA media</p> <p>qemu-11.0.2-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11250-1 https://cve.radiocsirt.org/vuln/rlsa-2026:39311 <p><strong>Affected:</strong> Rocky Linux:9: qemu-kvm</p> <p>Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.</p> <p>Security Fix(es):</p> <p>* qemu-kvm: Heap buffer overflow in virtio-blk SCSI request handling (CVE-2026-48914)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> Rocky Linux:9: qemu-kvm</p> <p>Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.</p> <p>Security Fix(es):</p> <p>* qemu-kvm: Heap buffer overflow in virtio-blk SCSI request handling (CVE-2026-48914)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/rlsa-2026:39311 https://cve.radiocsirt.org/vuln/suse-su-2026:22550-1 <p>Security update for qemu</p> <p>Security update for qemu</p> https://cve.radiocsirt.org/vuln/suse-su-2026:22550-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-48914 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: qemu, Ubuntu:Pro:16.04:LTS: qemu, Ubuntu:Pro:18.04:LTS: qemu, Ubuntu:Pro:20.04:LTS: qemu, Ubuntu:22.04:LTS: qemu, Ubuntu:24.04:LTS: qemu, Ubuntu:25.10: qemu, Ubuntu:26.04:LTS: qemu, Ubuntu:26.04:LTS: qemu-hwe</p> <p>A flaw was found in QEMU&#39;s virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors before writing data. A malicious guest with high privileges could exploit this vulnerability by submitting a malformed virtio-blk SCSI request, leading to an out-of-bounds write in the host heap memory and a potential denial of service (DoS) for the QEMU process.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: qemu, Ubuntu:Pro:16.04:LTS: qemu, Ubuntu:Pro:18.04:LTS: qemu, Ubuntu:Pro:20.04:LTS: qemu, Ubuntu:22.04:LTS: qemu, Ubuntu:24.04:LTS: qemu, Ubuntu:25.10: qemu, Ubuntu:26.04:LTS: qemu, Ubuntu:26.04:LTS: qemu-hwe</p> <p>A flaw was found in QEMU&#39;s virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors before writing data. A malicious guest with high privileges could exploit this vulnerability by submitting a malformed virtio-blk SCSI request, leading to an out-of-bounds write in the host heap memory and a potential denial of service (DoS) for the QEMU process.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-48914 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1908 <p>Ein lokaler Angreifer kann eine Schwachstelle in QEMU ausnutzen, um einen Denial-of-Service Zustand herbeizuführen und möglicherweise um beliebigen Code auf dem Host auszuführen.</p> <p>Ein lokaler Angreifer kann eine Schwachstelle in QEMU ausnutzen, um einen Denial-of-Service Zustand herbeizuführen und möglicherweise um beliebigen Code auf dem Host auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1908