QEMU
83 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-3842 | 7.1.0 – < 11.0.0 | Qemu-kvm: hyperv/syndbg: missing mapped-length guard after cpu_physical_memory_map causes host oob write | HIGH 7.8 | 0.2 % | ||
| CVE-2026-3195 | 8.2.0 – 10.2.1 | Qemu-kvm: virtio-snd: heap buffer overflow in virtio_snd_pcm_in_cb (incomplete fix for cve-2024-7730) | HIGH 7.4 | 0.2 % | ||
| CVE-2026-3196 | 8.2.0 – 10.2.1 | Qemu-kvm: virtio-snd: integer overflow leading to unbounded memory allocation | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-48914 | 1.1.0 – 11.0.1 | Qemu-kvm: heap buffer overflow in virtio-blk scsi request handling | MEDIUM 6.7 | 0.2 % | ||
| CVE-2026-2243 | ≤ 10.2.1 | Qemu-kvm: heap buffer out-of-bounds read in vmdk compressed grain parsing | MEDIUM 5.1 | 0.1 % | ||
| CVE-2026-0665 | 8.0.0 – 10.2.0 | Qemu-kvm: heap off-by-one in kvm xen physdevop_map_pirq | MEDIUM 6.5 | 0.2 % | ||
| CVE-2025-8860 | 10.0.0 – < 10.1.0 | Qemu-kvm: uefi-vars: information disclosure vulnerability in uefi_vars_write callback | LOW 3.3 | 0.2 % | ||
| CVE-2025-14876 | 7.1.0 – 10.2.0 | Qemu-kvm: unbounded allocation in virtio-crypto | MEDIUM 5.5 | 0.2 % | ||
| CVE-2025-12464 | 8.1.0 – < 10.1.3 | Qemu-kvm: stack buffer overflow in e1000 device via short frames in loopback mode | MEDIUM 6.2 | 0.2 % | ||
| CVE-2025-11234 | 2.6.0 – < 10.1.2 | Qemu-kvm: vnc websocket handshake use-after-free | HIGH 7.5 | 0.9 % | ||
| CVE-2024-7730 | < 9.1.0 | Qemu-kvm: virtio-snd: heap buffer overflow in virtio_snd_pcm_in_cb() | HIGH 7.8 | 0.3 % | ||
| CVE-2024-3447 | 1.5.0 – < 9.0.0 | Qemu: sdhci: heap buffer overflow in sdhci_write_dataport() | MEDIUM 6.0 | 0.6 % | ||
| CVE-2024-6519 | | Qemu: scsi: lsi53c895a: use-after-free local privilege escalation vulnerability | HIGH 8.2 | 0.2 % | ||
| CVE-2024-8612 | corrigé en 637b0aa139565cb82a7b9269e62214f87082635c | Qemu-kvm: information leak in virtio devices | LOW 3.8 | 0.2 % | ||
| CVE-2024-8354 | | Qemu-kvm: usb: assertion failure in usb_ep_get() | MEDIUM 5.5 | 0.3 % | ||
| CVE-2024-7409 | corrigé en 7.2.0, 8.2.0, 9.0.0 | Qemu: denial of service via improper synchronization in qemu nbd server during socket closure | HIGH 7.5 | 1.0 % | ||
| CVE-2024-6505 | 5.1.0 – < 9.1.0 | Qemu-kvm: virtio-net: queue index out-of-bounds access in software rss | MEDIUM 6.8 | 0.7 % | ||
| CVE-2024-4467 | 4.0.0 – < 9.1.0 | Qemu-kvm: 'qemu-img info' leads to host file read/write | HIGH 7.8 | 0.3 % | ||
| CVE-2024-4693 | corrigé en 7eeb62b0ce3a8f64647bf53f93903abd1fbb0b94 | Qemu-kvm: virtio-pci: improper release of configure vector leads to guest triggerable crash | MEDIUM 5.5 | 0.3 % | ||
| CVE-2023-2861 | corrigé en 8.1.0-rc0 | Qemu: 9pfs: improper access control on special files | HIGH 7.1 | 0.4 % | ||
| CVE-2023-2680 | | Dma reentrancy issue (incomplete fix for cve-2021-3750) | HIGH 8.2 | 0.2 % | ||
| CVE-2023-3301 | corrigé en 8.1.0-rc0 | Triggerable assertion due to race condition in hot-unplug | MEDIUM 5.6 | 0.3 % | ||
| CVE-2023-3180 | | Heap buffer overflow in virtio_crypto_sym_op_helper() | MEDIUM 6.5 | 0.2 % | ||
| CVE-2023-1386 | | Qemu: 9pfs: suid/sgid bits not dropped on file write | HIGH 7.8 | 0.2 % | ||
| CVE-2023-3354 | | Improper i/o watch removal in tls handshake can lead to remote unauthenticated denial of service | HIGH 7.5 | 1.6 % | ||
| CVE-2023-0664 | unknown | A flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be able to manipulate the QEMU Guest Agent's Win | HIGH 7.8 | 0.3 % | ||
| CVE-2023-1544 | corrigé en 8.2.0-rc0 | Qemu: pvrdma: out-of-bounds read in pvrdma_ring_next_elem_read() | MEDIUM 6.3 | 0.3 % | ||
| CVE-2023-0330 | corrigé en 8.1.0-rc0 | Qemu: lsi53c895a: dma reentrancy issue leads to stack overflow | MEDIUM 6.0 | 0.3 % | ||
| CVE-2022-3872 | Affected: up to latest v7.1.0-rc4 | An off-by-one read/write issue was found in the SDHCI device of QEMU. It occurs when reading/writing the Buffer Data Port Register in sdhci_ | HIGH 8.6 | 0.9 % | ||
| CVE-2022-3165 | Affected 6.1.0 and later. Will be fixed in 7.2.0-rc0. | An integer underflow issue was found in the QEMU VNC server while processing ClientCutText messages in the extended format. A malicious clie | MEDIUM 6.5 | 1.6 % | ||
| CVE-2022-2962 | Will be fixed in QEMU 7.2.0-rc0 | A DMA reentrancy issue was found in the Tulip device emulation in QEMU. When Tulip reads or writes to the rx/tx descriptor or copies the rx/ | HIGH 7.8 | 0.4 % | ||
| CVE-2021-3735 | Not Known | A deadlock issue was found in the AHCI controller device of QEMU. It occurs on a software reset (ahci_reset_port) while handling a host-to-d | MEDIUM 4.4 | 0.2 % | ||
| CVE-2022-0216 | Affects QEMU < v6.0.0, Fixed in v7.1.0-rc0 | A use-after-free vulnerability was found in the LSI53C895A SCSI Host Bus Adapter emulation of QEMU. The flaw occurs while processing repeate | MEDIUM 4.4 | 0.4 % | ||
| CVE-2021-3929 | Fixed in qemu-kvm 7.0.0-rc0 | A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is similar to CVE-2021-3750 and, just like | HIGH 8.2 | 0.7 % | ||
| CVE-2021-4158 | Affects v6.0.0 and above. | A NULL pointer dereference issue was found in the ACPI code of QEMU. A malicious, privileged user within the guest could use this flaw to cr | MEDIUM 6.0 | 0.4 % | ||
| CVE-2020-14394 | QEMU 6.1.50 | An infinite loop flaw was found in the USB xHCI controller emulation of QEMU while computing the length of the Transfer Request Block (TRB) | LOW 3.2 | 0.4 % | ||
| CVE-2021-3611 | QEMU versions prior to 7.0.0 | A stack overflow vulnerability was found in the Intel HD Audio device (intel-hda) of QEMU. A malicious guest could use this flaw to crash th | MEDIUM 6.5 | 0.5 % | ||
| CVE-2021-3750 | QEMU before version 7.0.0 | A DMA reentrancy issue was found in the USB EHCI controller emulation of QEMU. EHCI does not verify if the Buffer Pointer overlaps with its | HIGH 8.2 | 0.5 % | ||
| CVE-2021-4206 | qemu-kvm 7.0.0 | A flaw was found in the QXL display device emulation in QEMU. An integer overflow in the cursor_alloc() function can lead to the allocation | HIGH 8.2 | 0.8 % | ||
| CVE-2021-4207 | qemu-kvm 7.0.0 | A flaw was found in the QXL display device emulation in QEMU. A double fetch of guest controlled values `cursor->header.width` and `cursor-> | HIGH 8.2 | 0.4 % | ||
| CVE-2021-20295 | qemu-kvm 4.2.0-34 | It was discovered that the update for the virt:rhel module in the RHSA-2020:4676 (https://access.redhat.com/errata/RHSA-2020:4676) erratum r | MEDIUM 6.5 | 0.3 % | ||
| CVE-2022-1050 | qemu 2.20.1 | A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to execute HW comma | HIGH 8.8 | 0.4 % | ||
| CVE-2021-3582 | qemu 2.17.2 | A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. The issue occurs while handling a "PVRDMA_CMD_CREATE_MR" co | MEDIUM 6.5 | 0.4 % | ||
| CVE-2021-20257 | Fixed-In v6.2.0 | An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx) descriptors in proc | MEDIUM 6.5 | 0.4 % | ||
| CVE-2021-3638 | Affects qemu v4.0 to v6.1 | An out-of-bounds memory access flaw was found in the ATI VGA device emulation of QEMU. This flaw occurs in the ati_2d_blt() routine while ha | MEDIUM 6.5 | 0.4 % | ||
| CVE-2021-3608 | qemu-kvm 6.1.0 | A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions prior to 6.1.0. The issue occurs while handling | MEDIUM 6.0 | 0.4 % | ||
| CVE-2021-3607 | qemu-kvm 6.1.0 | An integer overflow was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions prior to 6.1.0. The issue occurs wh | MEDIUM 6.0 | 0.3 % | ||
| CVE-2021-3947 | qemu-kvm 6.2.0-rc2 | A stack-buffer-overflow was found in QEMU in the NVME component. The flaw lies in nvme_changed_nslist() where a malicious guest controlling | MEDIUM 5.5 | 0.3 % | ||
| CVE-2021-3930 | qemu-kvm 6.2.0-rc0 | An off-by-one error was found in the SCSI device emulation in QEMU. It could occur while processing MODE SELECT commands in mode_sense_page( | MEDIUM 6.5 | 0.3 % | ||
| CVE-2021-4145 | qemu-kvm 6.2.0 | A NULL pointer dereference issue was found in the block mirror layer of QEMU in versions prior to 6.2.0. The `self` pointer is dereferenced | MEDIUM 6.5 | 0.4 % | ||
| CVE-2021-3713 | qemu 6.2.0-rc0 | An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device use | HIGH 7.4 | 0.6 % | ||
| CVE-2021-3682 | qemu 6.1.0-rc2 | A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs when dropping packets during a bul | HIGH 8.5 | 2.9 % | ||
| CVE-2021-3595 | libslirp 4.6.0 | An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the tftp_input() functi | LOW 3.8 | 0.3 % | ||
| CVE-2021-3594 | libslirp 4.6.0 | An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp_input() functio | LOW 3.8 | 0.3 % | ||
| CVE-2021-3593 | libslirp 4.6.0 | An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp6_input() functi | LOW 3.8 | 0.3 % | ||
| CVE-2021-3592 | libslirp 4.6.0 | An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the bootp_input() funct | LOW 3.8 | 0.3 % | ||
| CVE-2021-3546 | All QEMU versions up to and including 6.0 | An out-of-bounds write vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including | HIGH 8.2 | 0.5 % | ||
| CVE-2021-3545 | All QEMU versions up to and including 6.0 | An information disclosure vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and includi | MEDIUM 6.5 | 0.4 % | ||
| CVE-2021-3544 | All QEMU versions up to and including 6.0 | Several memory leaks were found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0. They exist | MEDIUM 6.5 | 0.4 % | ||
| CVE-2020-35503 | All QEMU versions before and including 6.0 | A NULL pointer dereference flaw was found in the megasas-gen2 SCSI host bus adapter emulation of QEMU in versions before and including 6.0. | MEDIUM 6.0 | 0.3 % | ||
| CVE-2013-4536 | qemu-kvm 1.5.3 | An user able to alter the savevm data (either on the disk or over the wire during migration) could use this flaw to to corrupt QEMU process | HIGH 7.8 | 0.3 % | ||
| CVE-2020-35506 | qemu 6.0.0 | A use-after-free vulnerability was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0 during the handlin | MEDIUM 6.7 | 0.4 % | ||
| CVE-2020-35505 | qemu 6.0.0 | A NULL pointer dereference flaw was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0. This issue occur | MEDIUM 4.4 | 0.3 % | ||
| CVE-2020-35504 | qemu 6.0.0 | A NULL pointer dereference flaw was found in the SCSI emulation support of QEMU in versions before 6.0.0. This flaw allows a privileged gues | MEDIUM 6.0 | 0.3 % | ||
| CVE-2021-20196 | vulnerable up to (including) qemu 5.2.0 | A NULL pointer dereference flaw was found in the floppy disk emulator of QEMU. This issue occurs while processing read/write ioport commands | MEDIUM 6.5 | 0.5 % | ||
| CVE-2021-3527 | all versions | A flaw was found in the USB redirector device (usb-redir) of QEMU. Small USB packets are combined into a single, large transfer request, to | MEDIUM 5.5 | 0.4 % | ||
| CVE-2021-20221 | up to, including qemu 4.2.0 | An out-of-bounds heap buffer access issue was found in the ARM Generic Interrupt Controller emulator of QEMU up to and including qemu 4.2.0o | MEDIUM 6.0 | 0.3 % | ||
| CVE-2021-20181 | up to, including 5.2.0 | A race condition flaw was found in the 9pfs server implementation of QEMU up to and including 5.2.0. This flaw allows a malicious 9p client | HIGH 7.5 | 0.3 % | ||
| CVE-2021-3507 | up to 6.0.0 (including) | A heap buffer overflow was found in the floppy disk emulator of QEMU up to 6.0.0 (including). It could occur in fdctrl_transfer_handler() in | MEDIUM 6.1 | 0.5 % | ||
| CVE-2021-3409 | up to (including) 5.2.0 | The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective, thus making QEMU vulnerable to the out-of-bounds read/write access | MEDIUM 5.7 | 0.5 % | ||
| CVE-2021-3392 | between 2.10.0 and 5.2.0 | A use-after-free flaw was found in the MegaRAID emulator of QEMU. This issue occurs while processing SCSI I/O requests in the case of an err | LOW 3.2 | 0.4 % | ||
| CVE-2021-3416 | versions up to and including 5.2.0 | A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU in versions up to and including 5.2.0. The iss | MEDIUM 6.0 | 0.5 % | ||
| CVE-2021-20255 | all versions | A stack overflow via an infinite recursion vulnerability was found in the eepro100 i8255x device emulator of QEMU. This issue occurs while p | MEDIUM 5.5 | 0.4 % | ||
| CVE-2021-20263 | qemu 5.2.50 | A flaw was found in the virtio-fs shared file system daemon (virtiofsd) of QEMU. The new 'xattrmap' option may cause the 'security.capabilit | LOW 3.3 | 0.4 % | ||
| CVE-2021-20203 | versions up to v5.2.0 | An integer overflow issue was found in the vmxnet3 NIC emulator of the QEMU for versions up to v5.2.0. It may occur if a guest was to supply | LOW 3.2 | 0.6 % | ||
| CVE-2020-35517 | qemu 5.2.0 | A flaw was found in qemu. A host privilege escalation issue was found in the virtio-fs shared file system daemon where a privileged guest us | HIGH 8.2 | 0.5 % | ||
| CVE-2020-27821 | prior to 5.2.0 | A flaw was found in the memory management API of QEMU during the initialization of a memory region cache. This issue could lead to an out-of | MEDIUM 6.0 | 0.4 % | ||
| CVE-2020-25723 | qemu 5.2.0 | A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while processing USB requests due to missing ha | LOW 3.2 | 0.4 % | ||
| CVE-2020-14364 | QEMU versions before 5.2.0 | An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processi | MEDIUM 5.0 | 5.4 % | ||
| CVE-2013-4535 | before 1.7.2 | The virtqueue_map_sg function in hw/virtio/virtio.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary files via a crafted sa | HIGH 8.8 | 1.0 % | ||
| CVE-2014-0148 | before 2.0 | Qemu before 2.0 block driver for Hyper-V VHDX Images is vulnerable to infinite loops and other potential issues when calculating BAT entries | MEDIUM 5.5 | 0.3 % | ||
| CVE-2014-0147 | before 1.6.2 | Qemu before 1.6.2 block diver for the various disk image formats used by Bochs and for the QCOW version 2 format, are vulnerable to a possib | MEDIUM 6.2 | 0.3 % | ||
| CVE-2016-9602 | qemu 2.9 | Qemu before version 2.9 is vulnerable to an improper link following when built with the VirtFS. A privileged user inside guest could use thi | HIGH 8.8 | 3.6 % |