Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain code execution inside guest VM
  2. Delivery
    Invoke emulated device DMA path
  3. Exploit
    cpu_physical_memory_map returns short buffer
  4. Execution
    Write past mapped region
  5. Persist
    Corrupt adjacent QEMU heap objects
  6. Impact
    Disclose memory or crash host process

Vulnerability Assessment

Weakness
CWE
CWE-787
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires the attacker to already have code execution inside a guest VM running under vulnerable QEMU (PR:L, local guest context) and the ability to reach the emulation path that calls cpu_physical_memory_map() with a request that returns a shortened mapping - typically an emulated device or DMA operation whose length crosses a memory-region boundary. Limiting factors: there is no remote or unauthenticated entry point (the attacker must first own a guest), no host-side user interaction is involved, and impact is bounded by the QEMU process privileges and whatever adjacent host-heap objects the attacker can groom. Whether corruption stays within guest-visible memory or reaches host state is not fully clear from the description (S:U in the vector) and should be verified against the vendor advisory.
Impact

The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) describes a low-complexity, low-privilege, local attack with high impact to all three properties - consistent with a guest-side memory-corruption primitive. No EPSS score, KEV entry, or POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation; this is a normal-cycle patch priority rather than an emergency. One caveat worth flagging: the description centers on guest memory and QEMU heap corruption while the vector uses S:U (scope unchanged) - a full guest-to-host escape would typically warrant S:C, so the true blast radius (guest-only corruption vs. host compromise) should be confirmed against the Red Hat/QEMU advisory. The broad multi-distro response (Red Hat, Ubuntu at medium priority, SUSE, Debian) indicates a real, widely applicable fix, not a signal of in-the-wild use.
Exploit ScenarioDerived

A malicious or compromised tenant with code execution inside a guest VM drives an emulated device operation that triggers a memory map where cpu_physical_memory_map() returns a short length, then forces the emulator to write past that buffer into adjacent QEMU heap objects. By grooming the host heap, the attacker corrupts a neighboring structure to leak memory or crash the VM process; no public POC is identified at time of analysis, and the low attack complexity means a working exploit would likely be reliable once developed.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 16, 2026

Out-of-bounds heap write in QEMU lets a local attacker operating inside a guest virtual machine corrupt memory in the host emulator process, enabling information disclosure, data-integrity corruption, or denial of service. The flaw stems from cpu_physical_memory_map() returning a shorter buffer length than the caller assumes, so subsequent writes spill past the allocation. Rated CVSS 7.8 (CWE-787); no public exploit identified at time of analysis, but multiple distributions (Red Hat, Ubuntu, SUSE, Debian) have shipped fixes.

RemediationAI

Apply the QEMU package updates from your distribution as the primary fix: Ubuntu via USN-8161-1 (https://ubuntu.com/security/notices/USN-8161-1), SUSE via the referenced SUSE-SU-2026 advisories (for example https://www.suse.com/support/update/SUSE-SU-2026:21883/), and Red Hat per its errata linked from https://access.redhat.com/security/cve/CVE-2026-3842 for RHEL 6-10 and OpenShift Container Platform 4. Because the affected code is core emulation, updating the QEMU packages and then restarting or live-migrating running guests is required for the fix to take effect, since a running VM keeps the vulnerable binary mapped until the process is recycled. Exact fixed versions are per-distro and should be cited from the advisories rather than assumed. If patching must be deferred, reduce exposure by limiting untrusted guests on shared hosts, minimizing emulated device surface (disable unneeded emulated devices or DMA/passthrough paths), and isolating multi-tenant workloads onto separate hosts; these controls shrink the attacker population and blast radius but do not remove the underlying flaw.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

QEMU is the machine emulator/virtualizer underpinning KVM-based virtualization across major Linux distributions and cloud/container platforms. The bug is a classic CWE-787 out-of-bounds write: device/DMA emulation code calls cpu_physical_memory_map() to obtain a host pointer into guest physical memory and writes an expected number of bytes, but the function can legitimately map fewer bytes than requested (for example when a request straddles a memory-region boundary or non-contiguous RAM). When the caller does not honor the shortened returned length, it writes beyond the mapped region into adjacent QEMU heap-allocated objects. Because this executes within the privileged QEMU process on the host, corruption of heap metadata or neighboring objects is the root primitive attackers would pursue.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (fedora) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.8 HIGH

Attacker needs guest code execution (AV:L, PR:L) via a low-complexity emulation path with no user interaction, yielding high C/I/A from host-process heap corruption; scope kept U per the description's focus on QEMU/guest memory.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Ubuntu MEDIUM
SUSE 5.1 MEDIUM
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Red Hat 7.8 HIGH

Primary rating from Vendor (fedora).

CVSS VectorVendor: fedora

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

A flaw was found in QEMU. This vulnerability allows a local attacker within a guest virtual machine to write data beyond its allocated memory. This occurs when cpu_physical_memory_map() returns a shorter length than expected, leading to an out-of-bounds write. Successful exploitation could result in unauthorized access to guest memory or corruption of heap-allocated objects, potentially causing information disclosure, data integrity issues, or a denial of service.

Executive ViewAI

Why It Matters

A critical memory corruption flaw in QEMU hypervisors (CVE-2026-3842, CVSS 7.8) allows guest virtual machine users to corrupt host system memory, creating risks of data theft, integrity violations, and service disruption across virtualized infrastructure. Organizations operating QEMU-based hypervisors in production must prioritize immediate remediation. The broad distribution of vulnerable QEMU versions across major Linux vendors increases organizational risk and justifies urgent patching.

Business Impact: High
Compensating Controls

Apply vendor patches available from Red Hat, Ubuntu, SUSE, or Debian based on affected system distribution.

Threat Intelligence Overview

EPSS Score
0.1%
Top 98% exploitable
Prevalence
High
QEMU underpins most KVM virtualization across enterprise Linux and cloud hosts
Social Media
1
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Small
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)CVE.org

cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_openshift_container_platform_4:*:*:*:*:*:*:*:*

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-96889 HIGH POC
7.8 Sep 23

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
CVE-2026-4775 HIGH POC
7.8 Mar 24

A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to

CVE-2026-114406 MEDIUM POC
6.8 Oct 21

The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Vendor StatusVendor

Ubuntu

Priority: Medium
qemu
Release Status Version
resolute needed -
trusty needs-triage -
xenial needs-triage -
bionic needs-triage -
focal needs-triage -
upstream needs-triage -
jammy not-affected code not present
noble released 1:8.2.2+ds-0ubuntu1.16
questing released 1:10.1.0+ds-5ubuntu2.6
USN-8161-1

Debian

qemu
Release Status Fixed Version Urgency
bullseye not-affected - -
bullseye (security) fixed 1:5.2+dfsg-11+deb11u5 -
bookworm vulnerable 1:7.2+dfsg-7+deb12u18 -
bookworm (security) vulnerable 1:7.2+dfsg-7+deb12u15 -
trixie fixed 1:10.0.10+ds-0+deb13u1 -
trixie (security) vulnerable 1:10.0.2+ds-2+deb13u1 -
forky, sid fixed 1:11.0.2+ds-2 -
(unstable) fixed 1:10.2.2+ds-1 -

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Image SL-Micro Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.161 Container suse/sl-micro/6.1/kvm-os-container:2.2.0-3.3 Affected
Container suse/sle-micro/kvm-5.5:2.0.4-3.5.543 Affected
Image SLES15-SP6-EC2-ECS-HVM Affected
Image SLES15-SP7-EC2-ECS-HVM Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-3842 ADVISORY https://ubuntu.com/security/notices/USN-8161-1 ADVISORY https://vuldb.com/vuln/358018 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21883/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21912/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2385/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2386/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2388/ REF https://access.redhat.com/security/cve/CVE-2026-3842 REF https://bugzilla.redhat.com/show_bug.cgi?id=2458150 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3842.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy