6.7

CVE-2026-48914: Qemu-kvm: heap buffer overflow in virtio-blk scsi request handling

Awaiting analysis
AliasesRHSA-2026:39311RHSA-2026:58571UBUNTU-CVE-2026-48914
Published 12-06-2026Last modified 31-08-2026

Vulnerability summary

CVE-2026-48914 is a medium (CVSS 6.7) Heap-based Buffer Overflow vulnerability in qemu. EPSS estimates a 0.16% chance of exploitation in the next 30 days, higher than 5% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 6.7, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
6.7/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.16%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 5 · Related 4
MGASA-2026-0334OPENSUSE-SU-2026:21253-1SUSE-SU-2026:22550-1SUSE-SU-2026:22576-1SUSE-SU-2026:3038-1

Timeline

  1. 12-06-2026
    PublishedVulnerability first disclosed.
  2. 31-08-2026
    Last modifiedVulnerability information updated.

Description

A flaw was found in QEMU's virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors before writing data. A malicious guest with high privileges could exploit this vulnerability by submitting a malformed virtio-blk SCSI request, leading to an out-of-bounds write in the host heap memory and a potential denial of service (DoS) for the QEMU process.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.16%

Chance of exploitation in the next 30 days

Percentile

5%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.16% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: local access, administrative account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat43 products
  • qemu-guest-agent< 17:10.1.0-17.el9_8.4 | < 18:10.1.0-16.el10_2.5
  • qemu-guest-agent-debuginfo< 17:10.1.0-17.el9_8.4 | < 18:10.1.0-16.el10_2.5
  • qemu-img< 17:10.1.0-17.el9_8.4 | < 18:10.1.0-16.el10_2.5
  • qemu-img-debuginfo< 17:10.1.0-17.el9_8.4 | < 18:10.1.0-16.el10_2.5
  • qemu-kvm< 17:10.1.0-17.el9_8.4 | < 18:10.1.0-16.el10_2.5
Ubuntu2 products
  • qemuAll versions (No fix recorded)
  • qemu-hweAll versions (No fix recorded)
Debian1 product
  • qemuAll versions (No fix recorded) | < 1:10.0.11+ds-0+deb13u1 | < 1:11.0.2+ds-1
Opensuse1 product
  • qemu&distro=openSUSE Tumbleweed< 11.0.2-1.1

4 vendors · 47 products

References

14 links
Show all 14 references