Skip to main content

QEMU CVE-2026-6426

| EUVDEUVD-2026-55840 MEDIUM
Incorrect Conversion between Numeric Types (CWE-681)
2026-08-10 secalert@redhat.com GHSA-f3xx-69mr-6rx6
Buffer Overflow
4.4
CVSS 3.1 · Vendor: redhat
Share

Severity by source

Vendor (redhat) PRIMARY
4.4 MEDIUM
AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.4 MEDIUM

Attacker must control the migration channel (PR:H); vhost inflight config plus little-endian host requirement adds genuine complexity (AC:H); impact is QEMU process crash only, no confirmed C/I impact.

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.0 MEDIUM
AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H
Red Hat
4.4 LOW
qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
High
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Analysis Generated
Aug 10, 2026 - 22:39 vuln.today
CVE Published
Aug 10, 2026 - 22:17 nvd
MEDIUM 4.4

DescriptionCVE.org

A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size is stored as a uint64_t but read by the VMS_VBUFFER load path as a signed int32_t. On little-endian hosts, a crafted incoming migration state with bit 31 set causes the value to be interpreted as negative and then implicitly converted to a very large size_t, leading qemu_get_buffer() to copy migration-stream data beyond the bounds of the mmap-backed inflight region.

This can result in a crash of the QEMU process or memory corruption. Exploitation requires control of the migration producer or write access to the migration channel, combined with a destination configured to use vhost inflight migration.

AnalysisAI

Out-of-bounds memory copy in QEMU's vhost inflight migration VMState handler allows a privileged attacker with control of the migration channel to crash the destination QEMU process or corrupt heap memory. The root cause is a numeric type mismatch - the inflight buffer size is stored as uint64_t but deserialized by the VMS_VBUFFER load path as signed int32_t, so a crafted value with bit 31 set wraps to a massive size_t, causing qemu_get_buffer() to read far beyond the mmap-backed inflight region. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; the CVSS score of 4.4 reflects the realistic high-privilege barrier to exploitation.

Technical ContextAI

QEMU implements live VM migration by serializing guest state through VMState descriptors. The vhost inflight migration subsystem tracks in-flight virtio I/O operations during migration to ensure consistency on the destination host. The vulnerable code path (CWE-681: Incorrect Conversion between Numeric Types) occurs in the VMS_VBUFFER deserialization handler, which loads the destination buffer size using a signed int32_t read despite the on-wire and internal representation using uint64_t. On little-endian hosts, a crafted migration stream sets bit 31 of the lower 32 bits, causing the int32_t to be interpreted as a large negative value. When that negative signed integer is implicitly promoted to the unsigned size_t argument of qemu_get_buffer(), C integer promotion rules wrap it to a value close to SIZE_MAX, causing the copy to overrun the mmap-backed inflight memory region. The affected code is in QEMU's vhost migration VMState handling; specific affected upstream version ranges were not enumerated in the available source data but can be confirmed via the Red Hat Bugzilla entry at https://bugzilla.redhat.com/show_bug.cgi?id=2513498.

Affected ProductsAI

QEMU on little-endian host architectures running configurations that enable vhost inflight migration is affected. Specific upstream version ranges were not enumerated in the available data; CPE strings were not provided in the source intelligence. Red Hat products incorporating QEMU are tracked under this CVE at https://access.redhat.com/security/cve/CVE-2026-6426, and the corresponding Bugzilla entry at https://bugzilla.redhat.com/show_bug.cgi?id=2513498 should be consulted for Red Hat Enterprise Linux package-level version details. Operators of other distributions (Debian, Ubuntu, SUSE) should check their respective security trackers for package-level impact.

RemediationAI

No specific patched QEMU version was confirmed in the available source data - the upstream fix commit or tagged release version should be verified against the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-6426 and Bugzilla entry https://bugzilla.redhat.com/show_bug.cgi?id=2513498 before deploying. As a compensating control, operators should restrict the QEMU migration channel to dedicated, trusted network segments using firewall ACLs or VLANs, preventing unauthorized parties from injecting crafted migration state even if they hold network access - this reduces attack surface with minimal operational impact. If vhost inflight migration is not required for the workload, disabling it entirely eliminates the vulnerable code path; the trade-off is that virtio device in-flight I/O may not be tracked across migration, which can affect storage consistency guarantees during live migration. Mutual authentication of migration endpoints (e.g., TLS with certificate pinning on the migration socket) raises the bar for channel injection attacks and is recommended regardless of this specific CVE.

Same weakness CWE-681 – Incorrect Conversion between Numeric Types

View all
CVE-2017-7308 HIGH POC
7.8
CVE-2016-3074 CRITICAL POC
9.8
CVE-2021-38187 CRITICAL POC
9.8
CVE-2022-34169 HIGH POC
7.5
CVE-2022-27882 HIGH POC
7.5
CVE-2021-27219 HIGH POC
7.5
CVE-2020-6582 HIGH POC
7.5
CVE-2019-16200 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected
SUSE Linux Enterprise Micro 5.5 Affected

Share

CVE-2026-6426 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy