ZDI-CAN-27628
HIGH 8.8
Overdue
Nov 19, 2025
QEMU
QEMU is a widely-used open-source machine emulator and virtualization platform. This high-severity vulnerability (CVSS 8.8) requires local access and low-level user privileges to exploit, but once compromised grants an attacker complete control over the system including data theft, modification, and service disruption. Security teams should prioritize patching QEMU installations and monitor for suspicious local activity, particularly from lower-privileged users attempting to exploit virtualization boundaries.
Advisory Details
Researcher
Discovered by:
Xiaobye(@xiaobye_tw) of DEVCORE Research Team
Reported
November 19, 2025
Deadline
March 19, 2026
29d overdue
CVSS Vector
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H