Contrast CVE-2026-100839

Requires the attacker to control the untrusted host/hypervisor (QEMU) that serves the confidential VM - this is the explicitly assumed adversary in Contrast's threat model, not a barrier for the intended attacker. Only applies to Contrast versions before 1.18.0 running on the AMD SEV-SNP platforms Metal-QEMU-SNP or Metal-QEMU-SNP-GPU. Metal-QEMU-TDX (Intel TDX) is NOT exploitable because ACPI table contents are measured into RTMR 0 by OVMF. Exploitation is limited to hosts able to supply ACPI/AML tables to the guest firmware; there is no remote-network path and no guest-user privilege escalation involved - the whole attack is host-to-guest across the confidential-computing trust boundary.

This is a genuine, high-integrity confidential-computing boundary break rather than a hyped high-CVSS issue, but its real-world urgency is bounded by prerequisites. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N, 8.4) correctly reflects that the attacker must already control the host/hypervisor (QEMU) - which is precisely the assumed adversary in Contrast's threat model, so PR:L/AV:L is not a mitigating accident but the whole point of the attack surface. The impact is severe within scope: full read/write of private guest memory and arbitrary code execution inside the confidential VM (VC:H/VI:H), defeating the core confidentiality/integrity guarantee Contrast exists to provide. No EPSS, no CISA KEV listing, and no CVE-specific proof-of-concept are provided in the input, so this is not confirmed as actively exploited. However, the underlying 'BadAML' technique is publicly documented (Black Hat EU 2024 briefing and a peer-reviewed ACM paper), meaning the method is well-understood by researchers even if a turnkey exploit is not indicated here. Net: a real, class-defining flaw for CC deployments on AMD SEV-SNP that operators should patch promptly, but exploitation is gated on host-level control rather than being remotely reachable by arbitrary internet attackers.

A malicious or compromised cloud host operator crafts an ACPI table containing malicious Turing-complete AML bytecode and presents it to a Contrast confidential guest via QEMU/OVMF. The guest Linux kernel's AML interpreter executes the bytecode with access to the full guest address space, letting the host read and modify the VM's private (supposedly host-inaccessible) memory and run arbitrary code inside the confidential VM. No standalone CVE-specific PoC is indicated in the input, though the general BadAML technique is publicly described in a 2024 Black Hat talk and ACM paper.