QEMU virtio-blk Device heap-based overflow

Summaryinfo

A vulnerability, which was classified as critical, was found in QEMU. Affected by this vulnerability is an unknown functionality of the component virtio-blk Device. Such manipulation leads to heap-based overflow. This vulnerability is listed as CVE-2026-48914. The attack must be carried out locally. There is no available exploit.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in QEMU (affected version not known). Affected by this issue is some unknown functionality of the component virtio-blk Device. The manipulation with an unknown input leads to a heap-based overflow vulnerability. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is integrity, and availability. CVE summarizes:

A flaw was found in QEMU's virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors before writing data. A malicious guest with high privileges could exploit this vulnerability by submitting a malformed virtio-blk SCSI request, leading to an out-of-bounds write in the host heap memory and a potential denial of service (DoS) for the QEMU process.

The advisory is shared for download at access.redhat.com. This vulnerability is handled as CVE-2026-48914 since 05/26/2026. The exploitation is known to be easy. The attack needs to be approached locally. Additional levels of successful authentication are necessary for exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 06/12/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at EUVD (EUVD-2026-36408) and CERT Bund (WID-SEC-2026-1908). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Affected

• Open Source QEMU

Productinfo

Type

• Virtualization Software

Name

• QEMU

License

• open-source

Website

• Product: https://www.qemu.org/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion