QEMU QXL CVE-2026-16271

Requires the QXL paravirtual display device to be attached to the guest (typical of SPICE-based desktop virtualization such as virt-manager, oVirt/RHV; not used in headless or virtio-gpu/VNC-only configurations), and requires the attacker to already control code within the guest at a level able to program the QXL device (guest kernel/driver). Exploitation is local to the host from the guest's perspective and does not require host authentication or user interaction, but the guest-driver access requirement and the non-universal use of qxl are the primary limiting factors; guests using other display backends are not exposed.

This is a QEMU guest-to-host memory-safety flaw in the paravirtual QXL/SPICE display device (hw/display/qxl), where the primary surface stride is not validated against the surface width. No CVSS vector, CWE, EPSS, KEV, or POC data was supplied, so all severity signals must be inferred from the patch title. The vulnerability class (missing bounds/consistency validation on a size field controlled by the guest) reliably yields out-of-bounds access in the host QEMU process, meaning the realistic worst case is host-memory information disclosure and a hypervisor-process crash (DoS); an OOB write leading to host code execution is plausible but cannot be confirmed from the title alone. Because exploitation requires an attacker who can already program the emulated device from inside a guest VM, this is a local-vector, scope-changing issue rather than a remote-unauthenticated one - a genuine virtualization-isolation concern in multi-tenant or untrusted-guest deployments, but not a mass-exploitation candidate. Absent EPSS/KEV/POC, treat as no confirmed exploitation; priority is driven by the isolation-boundary crossing, not by exploitation evidence. KEY GAPS: exact impact (read vs write), affected QEMU versions, and CVSS are all unconfirmed and should be verified against the Ubuntu USN and upstream qemu-devel commit.

A malicious or compromised guest with kernel/driver-level access to the emulated QXL device creates a primary surface whose declared stride is inconsistent with its width. When the host QEMU process subsequently processes or renders that surface, the mismatched stride drives an out-of-bounds read (or write) in host memory, leaking hypervisor data or crashing the VM's QEMU process. No public exploit code has been identified at time of analysis.