QEMU CVE-2026-77913

Requires the target VM to be configured with QEMU's emulated VGA display adapter (a common default) and an attacker who already controls the guest (guest kernel/driver-level access or the ability to perform VGA I/O-port/MMIO programming from within the guest). The specific trigger is a state sequence: switching the display to a graphics surface and then invoking text-mode rendering, which reaches the OOB write. Limiting factors: the attacker must first have code execution inside a guest (no remote network path to an unrelated party), the host must run an unpatched QEMU with VGA emulation enabled, and reaching the flawed path depends on the ability to manipulate VGA device state - deployments using non-VGA display backends (e.g., virtio-gpu only) are not affected.

No CVSS vector, CWE, EPSS, KEV, POC, or SSVC data was provided in the input - the only signals are the commit-style description and the reporting source (vendor:ubuntu). The description ('hw/display/vga: fix text-mode OOB write after a graphics surface switch') unambiguously identifies this as an out-of-bounds write in QEMU's emulated VGA display device, a guest-to-host attack surface. Risk must therefore be inferred rather than confirmed. The realistic threat model is a malicious or already-compromised guest VM that drives the emulated VGA adapter into an inconsistent state (switching to a graphics surface and then rendering in text mode), triggering an OOB write in the host QEMU process. This is a locally-triggered flaw from the attacker's perspective (the attacker executes inside the guest, AV:L) but crosses a security boundary to the host (scope change), which is what makes VMM device-emulation bugs high-priority in multi-tenant/cloud environments. At minimum this yields host-side denial of service (QEMU crash killing the guest and potentially neighbors on shared infrastructure); memory-corruption OOB writes in QEMU device models have historically been escalated to host code execution (guest escape), though that outcome is NOT confirmed for this specific CVE. Net: this is a genuine priority for virtualization/cloud operators despite the absence of a published CVSS score, precisely because QEMU is ubiquitous and the bug sits on the guest→host trust boundary - but exploitation maturity is unproven (no KEV, no POC identified).

A tenant with control of a guest VM programs the emulated VGA device to allocate/switch to a graphics-mode surface and then forces text-mode rendering, hitting the unfixed code path and causing an out-of-bounds write in the host QEMU process. In the benign case this crashes QEMU and denies service to that guest (and co-located tenants on shared hosts); in the worst case the controlled OOB write is leveraged toward host memory corruption and a guest-to-host escape. No public exploit code was identified in the provided data.