Vulnerability-Lookup

OESA-2026-2952 (CVE-2026-3886)

Vulnerability from osv_openeuler – Published: 2026-07-09 11:11 – Updated: 2026-08-06 11:11 – Source website

Summary

qemu security update

Details

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.

Security Fix(es):

A vulnerability, which was classified as critical, has been found in QEMU (Virtualization Software) (version unknown).Using CWE to declare the problem leads to CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control.Impacted is confidentiality, integrity, and availability.Upgrading eliminates this vulnerability.(CVE-2026-3886)

A flaw was found in QEMU's virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors before writing data. A malicious guest with high privileges could exploit this vulnerability by submitting a malformed virtio-blk SCSI request, leading to an out-of-bounds write in the host heap memory and a potential denial of service (DoS) for the QEMU process.(CVE-2026-48914)

Severity

8.8 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-3886	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-48914	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "qemu-8.2.0-56.oe2403sp1.aarch64.rpm",
          "qemu-block-curl-8.2.0-56.oe2403sp1.aarch64.rpm",
          "qemu-block-iscsi-8.2.0-56.oe2403sp1.aarch64.rpm",
          "qemu-block-rbd-8.2.0-56.oe2403sp1.aarch64.rpm",
          "qemu-block-ssh-8.2.0-56.oe2403sp1.aarch64.rpm",
          "qemu-debuginfo-8.2.0-56.oe2403sp1.aarch64.rpm",
          "qemu-debugsource-8.2.0-56.oe2403sp1.aarch64.rpm",
          "qemu-guest-agent-8.2.0-56.oe2403sp1.aarch64.rpm",
          "qemu-hw-usb-host-8.2.0-56.oe2403sp1.aarch64.rpm",
          "qemu-img-8.2.0-56.oe2403sp1.aarch64.rpm",
          "qemu-system-aarch64-8.2.0-56.oe2403sp1.aarch64.rpm",
          "qemu-system-arm-8.2.0-56.oe2403sp1.aarch64.rpm",
          "qemu-system-riscv-8.2.0-56.oe2403sp1.aarch64.rpm",
          "qemu-system-x86_64-8.2.0-56.oe2403sp1.aarch64.rpm",
          "qemu-user-8.2.0-56.oe2403sp1.aarch64.rpm",
          "qemu-user-binfmt-8.2.0-56.oe2403sp1.aarch64.rpm",
          "qemu-user-static-8.2.0-56.oe2403sp1.aarch64.rpm"
        ],
        "noarch": [
          "qemu-help-8.2.0-56.oe2403sp1.noarch.rpm"
        ],
        "src": [
          "qemu-8.2.0-56.oe2403sp1.src.rpm"
        ],
        "x86_64": [
          "qemu-8.2.0-56.oe2403sp1.x86_64.rpm",
          "qemu-block-curl-8.2.0-56.oe2403sp1.x86_64.rpm",
          "qemu-block-iscsi-8.2.0-56.oe2403sp1.x86_64.rpm",
          "qemu-block-rbd-8.2.0-56.oe2403sp1.x86_64.rpm",
          "qemu-block-ssh-8.2.0-56.oe2403sp1.x86_64.rpm",
          "qemu-debuginfo-8.2.0-56.oe2403sp1.x86_64.rpm",
          "qemu-debugsource-8.2.0-56.oe2403sp1.x86_64.rpm",
          "qemu-guest-agent-8.2.0-56.oe2403sp1.x86_64.rpm",
          "qemu-hw-usb-host-8.2.0-56.oe2403sp1.x86_64.rpm",
          "qemu-img-8.2.0-56.oe2403sp1.x86_64.rpm",
          "qemu-seabios-8.2.0-56.oe2403sp1.x86_64.rpm",
          "qemu-system-aarch64-8.2.0-56.oe2403sp1.x86_64.rpm",
          "qemu-system-arm-8.2.0-56.oe2403sp1.x86_64.rpm",
          "qemu-system-riscv-8.2.0-56.oe2403sp1.x86_64.rpm",
          "qemu-system-x86_64-8.2.0-56.oe2403sp1.x86_64.rpm",
          "qemu-user-8.2.0-56.oe2403sp1.x86_64.rpm",
          "qemu-user-binfmt-8.2.0-56.oe2403sp1.x86_64.rpm",
          "qemu-user-static-8.2.0-56.oe2403sp1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP1",
        "name": "qemu",
        "purl": "pkg:rpm/openEuler/qemu\u0026distro=openEuler-24.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.2.0-56.oe2403sp1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.\r\n\r\nSecurity Fix(es):\n\nA vulnerability, which was classified as critical, has been found in QEMU (Virtualization Software) (version unknown).Using CWE to declare the problem leads to CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control.Impacted is confidentiality, integrity, and availability.Upgrading eliminates this vulnerability.(CVE-2026-3886)\n\nA flaw was found in QEMU\u0026apos;s virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors before writing data. A malicious guest with high privileges could exploit this vulnerability by submitting a malformed virtio-blk SCSI request, leading to an out-of-bounds write in the host heap memory and a potential denial of service (DoS) for the QEMU process.(CVE-2026-48914)",
  "id": "OESA-2026-2952",
  "modified": "2026-08-06T11:11:51Z",
  "published": "2026-07-09T11:11:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2952"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3886"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48914"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "qemu security update",
  "upstream": [
    "CVE-2026-3886",
    "CVE-2026-48914"
  ]
}

CVE-2026-48914 (GCVE-0-2026-48914)

Vulnerability from cvelistv5 – Published: 2026-06-12 09:42 – Updated: 2026-08-31 17:13

Title

Qemu-kvm: heap buffer overflow in virtio-blk scsi request handling

Summary

Severity

6.7 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-12 09:57 UTC

CWE

CWE-122 - Heap-based Buffer Overflow

Assigner

redhat redhat root

References

5 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:39311	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:58571	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-48914	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2488283	issue-trackingx_refsource_REDHAT
https://lore.kernel.org/qemu-devel/20260526154957…

Impacted products

8 products

Vendor	Product	Version
		Affected: 1.1.0 , ≤ 11.0.1 (semver)
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 18:10.1.0-16.el10_2.5 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 17:10.1.0-17.el9_8.4 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux for NVIDIA 26	cpe:/a:redhat:enterprise_linux_nvidia:
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4

Date Public

2026-05-26 00:00

Credits

Red Hat would like to thank Feifan Qian <bea1e@proton.me> for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48914",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-12T09:57:24.232821Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-12T09:57:53.555Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://gitlab.com/qemu-project/qemu",
          "defaultStatus": "unaffected",
          "packageName": "qemu",
          "versions": [
            {
              "lessThanOrEqual": "11.0.1",
              "status": "affected",
              "version": "1.1.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.2"
          ],
          "defaultStatus": "affected",
          "packageName": "qemu-kvm",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "18:10.1.0-16.el10_2.5",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "qemu-kvm",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "17:10.1.0-17.el9_8.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "unknown",
          "packageName": "qemu-kvm",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "unknown",
          "packageName": "qemu-kvm",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "unknown",
          "packageName": "qemu-kvm-ma",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "virt:rhel/qemu-kvm",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux_nvidia:"
          ],
          "defaultStatus": "affected",
          "packageName": "qemu-kvm",
          "product": "Red Hat Enterprise Linux for NVIDIA 26",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift/ose-rhel-coreos-8",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift/ose-rhel-coreos-9",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Feifan Qian \u003cbea1e@proton.me\u003e for reporting this issue."
        }
      ],
      "datePublic": "2026-05-26T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in QEMU\u0027s virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors before writing data. A malicious guest with high privileges could exploit this vulnerability by submitting a malformed virtio-blk SCSI request, leading to an out-of-bounds write in the host heap memory and a potential denial of service (DoS) for the QEMU process."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-31T17:13:45.851Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:39311",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:39311"
        },
        {
          "name": "RHSA-2026:58571",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:58571"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-48914"
        },
        {
          "name": "RHBZ#2488283",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488283"
        },
        {
          "url": "https://lore.kernel.org/qemu-devel/20260526154957.1741622-1-stefanha@redhat.com/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-06-12T09:09:42.108Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-05-26T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Qemu-kvm: heap buffer overflow in virtio-blk scsi request handling",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-122: Heap-based Buffer Overflow"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-48914",
    "datePublished": "2026-06-12T09:42:36.313Z",
    "dateReserved": "2026-05-26T12:51:11.502Z",
    "dateUpdated": "2026-08-31T17:13:45.851Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

OESA-2026-2952 (CVE-2026-3886)

CVE-2026-48914 (GCVE-0-2026-48914)

Tags

Sightings

Nomenclature

Related by attack behaviour