Red Hat QEMU VMState qemu_get_buffer memory corruption

Summaryinfo

A vulnerability has been found in Red Hat QEMU and classified as critical. This vulnerability affects the function qemu_get_buffer of the component VMState Handler. The manipulation leads to memory corruption. This vulnerability is traded as CVE-2026-6426. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Red Hat QEMU (the affected version unknown). This issue affects the function qemu_get_buffer of the component VMState Handler. The manipulation with an unknown input leads to a memory corruption vulnerability. Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size is stored as a uint64_t but read by the VMS_VBUFFER load path as a signed int32_t. On little-endian hosts, a crafted incoming migration state with bit 31 set causes the value to be interpreted as negative and then implicitly converted to a very large size_t, leading qemu_get_buffer() to copy migration-stream data beyond the bounds of the mmap-backed inflight region. This can result in a crash of the QEMU process or memory corruption. Exploitation requires control of the migration producer or write access to the migration channel, combined with a destination configured to use vhost inflight migration.

The advisory is shared at access.redhat.com. The identification of this vulnerability is CVE-2026-6426 since 04/16/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details are known, but no exploit is available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 08/11/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-55840). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Virtualization Software

Vendor

• Red Hat

Name

• QEMU

License

• open-source

Website

• Vendor: https://www.redhat.com/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion