OESA-2026-1354 (CVE-2025-11234)

Vulnerability from osv_openeuler – Published: 2026-02-13 11:10 – Updated: 2026-08-06 11:10 – Source website
VLAI
Summary
qemu security update
Details

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.

Security Fix(es):

A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication.(CVE-2025-11234)

A stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and moved to the net core code. The issue stems from the device's receive code still being able to process a short frame in loopback mode. This could lead to a buffer overrun in the e1000_receive_iov() function via the loopback code path. A malicious guest user could use this vulnerability to crash the QEMU process on the host, resulting in a denial of service.(CVE-2025-12464)

An "off by one" bug has been discovered in QEMU's KVM Xen guest support. A malicious client could exploit this vulnerability to trigger an out-of-bounds heap access in the QEMU process via the simulated Xen physical device overshoot interface, resulting in a denial of service or potential memory corruption.(CVE-2026-0665)

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
To clipboard 

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "qemu-8.2.0-53.oe2403.aarch64.rpm",
          "qemu-block-curl-8.2.0-53.oe2403.aarch64.rpm",
          "qemu-block-iscsi-8.2.0-53.oe2403.aarch64.rpm",
          "qemu-block-rbd-8.2.0-53.oe2403.aarch64.rpm",
          "qemu-block-ssh-8.2.0-53.oe2403.aarch64.rpm",
          "qemu-debuginfo-8.2.0-53.oe2403.aarch64.rpm",
          "qemu-debugsource-8.2.0-53.oe2403.aarch64.rpm",
          "qemu-guest-agent-8.2.0-53.oe2403.aarch64.rpm",
          "qemu-hw-usb-host-8.2.0-53.oe2403.aarch64.rpm",
          "qemu-img-8.2.0-53.oe2403.aarch64.rpm",
          "qemu-system-aarch64-8.2.0-53.oe2403.aarch64.rpm",
          "qemu-system-arm-8.2.0-53.oe2403.aarch64.rpm",
          "qemu-system-riscv-8.2.0-53.oe2403.aarch64.rpm",
          "qemu-system-x86_64-8.2.0-53.oe2403.aarch64.rpm",
          "qemu-user-8.2.0-53.oe2403.aarch64.rpm",
          "qemu-user-binfmt-8.2.0-53.oe2403.aarch64.rpm",
          "qemu-user-static-8.2.0-53.oe2403.aarch64.rpm"
        ],
        "noarch": [
          "qemu-help-8.2.0-53.oe2403.noarch.rpm"
        ],
        "src": [
          "qemu-8.2.0-53.oe2403.src.rpm"
        ],
        "x86_64": [
          "qemu-8.2.0-53.oe2403.x86_64.rpm",
          "qemu-block-curl-8.2.0-53.oe2403.x86_64.rpm",
          "qemu-block-iscsi-8.2.0-53.oe2403.x86_64.rpm",
          "qemu-block-rbd-8.2.0-53.oe2403.x86_64.rpm",
          "qemu-block-ssh-8.2.0-53.oe2403.x86_64.rpm",
          "qemu-debuginfo-8.2.0-53.oe2403.x86_64.rpm",
          "qemu-debugsource-8.2.0-53.oe2403.x86_64.rpm",
          "qemu-guest-agent-8.2.0-53.oe2403.x86_64.rpm",
          "qemu-hw-usb-host-8.2.0-53.oe2403.x86_64.rpm",
          "qemu-img-8.2.0-53.oe2403.x86_64.rpm",
          "qemu-seabios-8.2.0-53.oe2403.x86_64.rpm",
          "qemu-system-aarch64-8.2.0-53.oe2403.x86_64.rpm",
          "qemu-system-arm-8.2.0-53.oe2403.x86_64.rpm",
          "qemu-system-riscv-8.2.0-53.oe2403.x86_64.rpm",
          "qemu-system-x86_64-8.2.0-53.oe2403.x86_64.rpm",
          "qemu-user-8.2.0-53.oe2403.x86_64.rpm",
          "qemu-user-binfmt-8.2.0-53.oe2403.x86_64.rpm",
          "qemu-user-static-8.2.0-53.oe2403.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS",
        "name": "qemu",
        "purl": "pkg:rpm/openEuler/qemu\u0026distro=openEuler-24.03-LTS"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.2.0-53.oe2403"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication.(CVE-2025-11234)\n\nA stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and moved to the net core code. The issue stems from the device\u0026apos;s receive code still being able to process a short frame in loopback mode. This could lead to a buffer overrun in the e1000_receive_iov() function via the loopback code path. A malicious guest user could use this vulnerability to crash the QEMU process on the host, resulting in a denial of service.(CVE-2025-12464)\n\nAn \u0026amp;quot;off by one\u0026amp;quot; bug has been discovered in QEMU\u0026amp;#39;s KVM Xen guest support. A malicious client could exploit this vulnerability to trigger an out-of-bounds heap access in the QEMU process via the simulated Xen physical device overshoot interface, resulting in a denial of service or potential memory corruption.(CVE-2026-0665)",
  "id": "OESA-2026-1354",
  "modified": "2026-08-06T11:10:23Z",
  "published": "2026-02-13T11:10:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1354"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11234"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12464"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0665"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "qemu security update",
  "upstream": [
    "CVE-2025-11234",
    "CVE-2025-12464",
    "CVE-2026-0665"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.