Skip to main content

QEMU. If CVE-2025-11234

| EUVDEUVD-2025-32560 HIGH
Use After Free (CWE-416)
2025-10-03 secalert@redhat.com
Denial Of Service Memory Corruption Use After Free
7.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Ubuntu
MEDIUM
qualitative
SUSE
HIGH
qualitative
Red Hat
7.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
EUVD ID Assigned
Mar 13, 2026 - 19:29 euvd
EUVD-2025-32560
Analysis Generated
Mar 13, 2026 - 19:29 vuln.today
CVE Published
Oct 03, 2025 - 11:15 nvd
HIGH 7.5

DescriptionCVE.org

A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication.

AnalysisAI

A flaw was found in QEMU.

Technical ContextAI

A use-after-free vulnerability occurs when a program continues to use a pointer after the referenced memory has been freed, leading to undefined behavior. This vulnerability is classified as Use After Free (CWE-416).

RemediationAI

Use memory-safe languages. Implement proper object lifecycle management. Use static and dynamic analysis tools to detect UAF patterns.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

Ubuntu

Priority: Medium
qemu
Release Status Version
upstream needs-triage -
bionic needed -
focal needed -
trusty needed -
xenial needed -
plucky ignored end of life, was needed
jammy released 1:6.2+dfsg-2ubuntu6.28
noble released 1:8.2.2+ds-0ubuntu1.13
questing released 1:10.1.0+ds-5ubuntu2.4
USN-8073-1

Debian

Bug #1117153
qemu
Release Status Fixed Version Urgency
bullseye vulnerable 1:5.2+dfsg-11+deb11u3 -
bullseye (security) vulnerable 1:5.2+dfsg-11+deb11u5 -
bookworm fixed 1:7.2+dfsg-7+deb12u18 -
bookworm (security) vulnerable 1:7.2+dfsg-7+deb12u15 -
trixie fixed 1:10.0.7+ds-0+deb13u1 -
trixie (security) vulnerable 1:10.0.2+ds-2+deb13u1 -
forky, sid fixed 1:10.2.1+ds-1 -
(unstable) fixed 1:10.1.3+ds-1 -

SUSE

Severity: High
Product Status
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.100 Container suse/sl-micro/6.1/kvm-os-container:2.2.0-3.3 Affected
Container suse/sle-micro-rancher/5.2:latest Affected
Container suse/sle-micro/kvm-5.5:2.0.4-3.5.443 Affected
Image SLES15-SP6-EC2-ECS-HVM Affected
Image SLES15-SP7-EC2-ECS-HVM Affected

Share

CVE-2025-11234 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy