CVE-2025-8860: Qemu-kvm: uefi-vars: information disclosure vulnerability in uefi_vars_write callback

Vulnerability summary

CVE-2025-8860 is a low (CVSS 3.3) vulnerability in qemu. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 5.9% of scored vulnerabilities.

Timeline

1. 18-02-2026
   PublishedVulnerability first disclosed.
2. 19-02-2026
   Last modifiedVulnerability information updated.

Description

A flaw was found in QEMU in the uefi-vars virtual device. When the guest writes to register UEFI_VARS_REG_BUFFER_SIZE, the .write callback `uefi_vars_write` is invoked. The function allocates a heap buffer without zeroing the memory, leaving the buffer filled with residual data from prior allocations. When the guest later reads from register UEFI_VARS_REG_PIO_BUFFER_TRANSFER, the .read callback `uefi_vars_read` returns leftover metadata or other sensitive process memory from the previously allocated buffer, leading to an information disclosure vulnerability.

• CWE-212Improper Removal of Sensitive Information Before Storage or TransferThe product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.