Skip to main content

QEMU CVE-2026-3195

| EUVDEUVD-2026-38043 HIGH
Heap-based Buffer Overflow (CWE-122)
2026-06-19 patrick@puiterwijk.org GHSA-x3gf-fc58-4mvj
Buffer Overflow Heap Overflow
7.4
CVSS 3.1 · Vendor: puiterwijk
Share

Severity by source

Vendor (puiterwijk) PRIMARY
7.4 HIGH
AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Guest-local vector (AV:L), high complexity for heap grooming (AC:H), requires privileged guest code to drive virtio-snd (PR:L), and VM-to-host escape crosses a security boundary (S:C).

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
SUSE
8.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Red Hat
7.4 HIGH
qualitative

Primary rating from Vendor (puiterwijk).

CVSS VectorVendor: puiterwijk

Attack Vector
Local
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
Analysis Generated
Jun 19, 2026 - 17:30 vuln.today

DescriptionCVE.org

A flaw was found in QEMU. When reading input audio in the virtio-snd device input callback, the virtio_snd_pcm_in_cb function did not check whether the iov could fit the data buffer, potentially leading to a heap out-of-bounds write. This issue exists due to an incomplete fix for CVE-2024-7730.

AnalysisAI

Heap out-of-bounds write in QEMU's virtio-snd paravirtualized sound device allows a malicious guest to corrupt host memory by sending oversized audio input that the virtio_snd_pcm_in_cb callback fails to size-check against the iov buffer. The flaw represents an incomplete fix for CVE-2024-7730 and affects hypervisor hosts exposing virtio-snd to untrusted guests. No public exploit identified at time of analysis, but the high CIA impact (C:H/I:H/A:H) and guest-to-host boundary crossing make this a meaningful VM escape candidate.

Technical ContextAI

QEMU implements a paravirtualized sound device following the virtio-snd specification, where the guest driver shares ring buffers (iov scatter-gather lists) with the QEMU device model on the host. The virtio_snd_pcm_in_cb callback delivers captured audio frames from the host backend into guest-shared memory, but does not validate that the cumulative size of incoming PCM data fits within the iov-described buffer, producing CWE-122 (heap-based buffer overflow). Because QEMU's device emulation runs in the host userspace process, an OOB write here corrupts heap memory belonging to the hypervisor process - the same class of bug pattern as CVE-2024-7730, whose prior patch evidently left this code path unguarded.

Affected ProductsAI

QEMU is affected in builds that expose the virtio-snd device to guests; the specific upstream version range and downstream Red Hat package versions are not enumerated in the provided data, but Red Hat tracking is available at the Red Hat security page https://access.redhat.com/security/cve/CVE-2026-3195 and the corresponding bugzilla https://bugzilla.redhat.com/show_bug.cgi?id=2443817. No CPE strings were supplied, so administrators should consult the Red Hat advisory and upstream QEMU release notes to map exact affected versions for their distribution.

RemediationAI

No vendor-released patch identified at time of analysis from the provided references; monitor https://access.redhat.com/security/cve/CVE-2026-3195 and https://bugzilla.redhat.com/show_bug.cgi?id=2443817 for the fixed QEMU package version and apply it as soon as it ships, prioritizing hosts that run untrusted guests. As an interim compensating control, do not attach the virtio-snd device to untrusted VMs - remove -device virtio-sound-pci (or libvirt <sound model='virtio'/>) and substitute an alternative audio model (e.g. ich9/ac97) or no audio device at all; the trade-off is loss of paravirtualized audio performance and guest sound functionality for affected VMs. Where audio is non-essential (servers, cloud workloads), disabling guest sound entirely is the cleanest mitigation.

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2025-25249 CRITICAL POC
9.8
CVE-2026-85880 HIGH POC
7.8
CVE-2025-24985 HIGH POC
7.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8
CVE-2023-23376 HIGH
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Image SL-Micro Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.161 Container suse/sl-micro/6.1/kvm-os-container:2.2.0-3.3 Affected
Image SLES15-SP6-EC2-ECS-HVM Affected
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed

Share

CVE-2026-3195 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy