Skip to main content

QEMU virtio-snd CVE-2026-3196

| EUVDEUVD-2026-38042 MEDIUM
Integer Overflow or Wraparound (CWE-190)
2026-06-19 patrick@puiterwijk.org GHSA-crqh-2v7r-3m9w
Denial Of Service Integer Overflow
5.5
CVSS 3.1 · Vendor: puiterwijk
Share

Severity by source

Vendor (puiterwijk) PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

AV:L and PR:L because exploitation requires low-privilege execution inside a guest VM; A:H for host memory exhaustion DoS; no confidentiality or integrity impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
6.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (puiterwijk).

CVSS VectorVendor: puiterwijk

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

1
Analysis Generated
Jun 19, 2026 - 17:31 vuln.today

DescriptionCVE.org

An integer overflow vulnerability was found in the virtio-snd device via PCM_INFO requests from the guest. A malicious guest can provide out-of-bounds stream counts, potentially leading to unbounded memory allocation on the host and a denial of service condition.

AnalysisAI

Integer overflow in QEMU's virtio-snd virtual sound device allows a malicious guest VM to trigger unbounded host memory allocation by supplying out-of-bounds stream counts via PCM_INFO requests, resulting in a host-side denial of service. Affected deployments are those where QEMU exposes the virtio-snd device to guest VMs - particularly relevant in multi-tenant or cloud virtualization environments where guest workloads may be untrusted. No public exploit code and no active exploitation (CISA KEV) has been identified at the time of this analysis; the CVSS 5.5 Medium score reflects the constrained local attack vector.

Technical ContextAI

The virtio-snd device is a VirtIO-compliant virtual audio controller implemented in QEMU, enabling guest VMs to interact with host audio subsystems through a standardized para-virtualized interface. PCM_INFO requests are part of the virtio-snd control protocol, used by the guest to enumerate available PCM streams and their capabilities. CWE-190 (Integer Overflow or Wraparound) describes the root cause: when the guest supplies a manipulated stream count value in a PCM_INFO request, an arithmetic overflow occurs during size calculations in the host QEMU process. This causes a subsequent memory allocation to be computed incorrectly - either too small or unboundedly large - ultimately exhausting host memory. The CVSS vector AV:L confirms that the guest-to-host boundary is the exploitation path; no CPE strings were provided, so exact affected QEMU versions must be derived from the Red Hat advisory and Bugzilla tracker.

Affected ProductsAI

The vulnerability affects the virtio-snd device implementation within QEMU. Exact affected version ranges and CPE strings were not provided in the available intelligence data and must be confirmed via the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-3196 and the associated Red Hat Bugzilla entry at https://bugzilla.redhat.com/show_bug.cgi?id=2443789. Red Hat Enterprise Linux and its derivatives shipping QEMU packages with the virtio-snd device enabled are likely affected.

RemediationAI

Consult the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-3196 for vendor-released patches and exact fixed package versions; no confirmed fixed version was available in the provided input data and should be verified directly. As a compensating control, if the virtio-snd device is not operationally required, administrators should remove the virtio-snd device from guest VM configurations (e.g., by omitting the relevant '-device virtio-snd-pci' argument or equivalent libvirt XML stanza) - this eliminates the attack surface entirely with no functional impact on guests that do not use audio. In multi-tenant environments, restricting the ability of guest operators to configure device types reduces exposure. Applying host-level memory limits (cgroups, QEMU memory balloon controls) can mitigate the severity of a DoS attempt but does not prevent the overflow itself and may cause guest instability as a trade-off.

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5
CVE-2016-1010 HIGH
8.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Image SL-Micro Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.161 Container suse/sl-micro/6.1/kvm-os-container:2.2.0-3.3 Affected
Image SLES15-SP6-EC2-ECS-HVM Affected
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed

Share

CVE-2026-3196 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy