CVE-2025-8860 in QEMU
Summary
by MITRE • 02/18/2026
A flaw was found in QEMU in the uefi-vars virtual device. When the guest writes to register UEFI_VARS_REG_BUFFER_SIZE, the .write callback `uefi_vars_write` is invoked. The function allocates a heap buffer without zeroing the memory, leaving the buffer filled with residual data from prior allocations. When the guest later reads from register UEFI_VARS_REG_PIO_BUFFER_TRANSFER, the .read callback `uefi_vars_read` returns leftover metadata or other sensitive process memory from the previously allocated buffer, leading to an information disclosure vulnerability.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/29/2026
This vulnerability exists within the QEMU virtualization environment's uefi-vars virtual device implementation, specifically affecting how heap memory is managed during UEFI variable operations. The flaw manifests when a guest operating system writes to the UEFI_VARS_REG_BUFFER_SIZE register, triggering the uefi_vars_write callback function that handles this specific write operation. The root cause stems from improper memory management practices where the allocation routine fails to initialize the newly allocated heap buffer with zero values before use. This omission creates a persistent security risk because the allocated memory block retains residual data from previous allocations within the same memory pool, including potentially sensitive metadata or process-specific information that was previously stored in those memory locations.
The operational impact of this vulnerability extends beyond simple information disclosure, as it allows malicious guest operating systems to extract confidential data that may have been previously stored in the heap memory areas. When subsequent read operations occur on the UEFI_VARS_REG_PIO_BUFFER_TRANSFER register through the uefi_vars_read callback, the function returns not only the intended data but also contaminated buffer contents containing remnants of prior memory allocations. This information leakage can potentially expose cryptographic keys, passwords, session tokens, or other sensitive process data that was stored in the same memory regions during previous operations. The vulnerability affects all systems running QEMU with UEFI variable support enabled, making it particularly concerning for virtualized environments where multiple guest operating systems share the same host resources and memory space.
This weakness aligns with CWE-119 Improper Access to Memory Location and CWE-248 Uncontrolled Resource Consumption, as the improper handling of allocated memory resources leads to information exposure through residual data access. The vulnerability also relates to ATT&CK technique T1059 Command and Scripting Interpreter where adversaries could leverage this information disclosure to gain insights into system internals or extract sensitive data that could aid in further exploitation attempts. The security implications extend to potential privilege escalation scenarios where an attacker with guest-level access could use the leaked information to craft more sophisticated attacks against the host system or other virtual machines sharing the same infrastructure, particularly in cloud computing environments where isolation between guests is critical.
Mitigation strategies should include immediate patching of QEMU versions containing this vulnerability, implementing proper memory initialization practices in all heap allocation routines within virtual device implementations, and deploying monitoring systems to detect anomalous UEFI variable access patterns. System administrators should also consider disabling UEFI variable support when not required for specific virtual machine configurations, as well as implementing stricter memory isolation techniques between different guest operating systems running on the same hypervisor platform. Additionally, regular security audits of virtualization components should be performed to identify similar memory management flaws that could potentially lead to information disclosure vulnerabilities in other device emulations within the same system architecture.