Debian Linux - qemu - None

Ubuntu Linux - ui/vnc: fix OOB read updating VNC update frequency stats

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  CVE-2026-48003


The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-500220 advisory.

    - tests/9p: add 3 xattr FID limit test cases (local fs driver) (Christian Schoenebeck) [Orabug: 39636027]     {CVE-2026-8348}
    - tests/9p: add 3 xattr FID limit test cases (synth fs driver) (Christian Schoenebeck) [Orabug: 39636027]     {CVE-2026-8348}
    - tests/9p: add virtio_9p_add_synth_driver_args() test client function (Christian Schoenebeck) [Orabug:
    39636027] {CVE-2026-8348}
    - tests/9p: increase P9_MAX_SIZE for test client (Christian Schoenebeck) [Orabug: 39636027]     {CVE-2026-8348}
    - hw/9pfs: add xattr count query interface to fs synth driver (Christian Schoenebeck) [Orabug: 39636027]     {CVE-2026-8348}
    - hw/9pfs: enable xattr (mockup) support for synth fs driver (Christian Schoenebeck) [Orabug: 39636027]     {CVE-2026-8348}
    - tests/9p: add Txattrcreate / Rxattrcreate test client functions (Christian Schoenebeck) [Orabug:
    39636027] {CVE-2026-8348}
    - tests/9p: add Tclunk / Rclunk test client functions (Christian Schoenebeck) [Orabug: 39636027]     {CVE-2026-8348}
    - tests/9p: add Tread / Rread test client functions (Christian Schoenebeck) [Orabug: 39636027]     {CVE-2026-8348}
    - qemu-options: document 9pfs max_xattr option (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}
    - hw/9pfs: add max_xattr option (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}
    - hw/9pfs: add xattr FID limit to prevent memory exhaustion (Christian Schoenebeck) [Orabug: 39636027]     {CVE-2026-8348}
    - hw/9pfs: cap Treaddir allocation (CVE-2026-9238) (Christian Schoenebeck) [Orabug: 39601986]     {CVE-2026-9238}
    - 9pfs/xen: implement response_buffer_size callback (Christian Schoenebeck) [Orabug: 39601986]     {CVE-2026-9238}
    - 9pfs/virtio: implement response_buffer_size callback (Christian Schoenebeck) [Orabug: 39601986]     {CVE-2026-9238}
    - hw/9pfs: add response_buffer_size transport callback (Christian Schoenebeck) [Orabug: 39601986]     {CVE-2026-9238}
    - hw/9pfs: cap negotiated msize to transport limit (Christian Schoenebeck) [Orabug: 39601986]     {CVE-2026-9238}
    - 9pfs/xen: implement msize_limit callback (Christian Schoenebeck) [Orabug: 39601986] {CVE-2026-9238}
    - 9pfs/virtio: implement msize_limit callback (Christian Schoenebeck) [Orabug: 39601986] {CVE-2026-9238}
    - hw/9pfs: add msize_limit transport callback (Christian Schoenebeck) [Orabug: 39601986] {CVE-2026-9238}
    - 9pfs: fix missing rename lock in v9fs_co_readdir_many (CVE-2026-48004) (sin99xx) [Orabug: 39478419]     {CVE-2026-48004}
    - tests/qtest/libqos: add qvirtqueue_reset_pool() for descriptor pool reset (Christian Schoenebeck)     [Orabug: 39636027] {CVE-2026-8348}
    - libvduse: fix buffer overflow in vduse_queue_read_indirect_desc() (Stefano Garzarella) [Orabug:
    39447322] {CVE-2026-6425}
    - libvhost-user: fix buffer overflow in virtqueue_read_indirect_desc() (Stefano Garzarella) [Orabug:
    39447322] {CVE-2026-6425}
    - virtio-blk: add missing VIRTIO_BLK_T_SCSI_CMD size check (CVE-2026-48914) (Stefan Hajnoczi) [Orabug:
    39522394] {CVE-2026-48914}
    - ui: fix validation of VNC extended clipboard data length (Heechan Kang) [Orabug: 39442988]     {CVE-2026-8343}
    - ui/vnc: fix OOB read updating VNC update frequency stats (Daniel P. Berrange) [Orabug: 39447326]     {CVE-2026-48003}
    - ui/vnc: fix OOB write in lossy rect worker code (Daniel P. Berrange) [Orabug: 39447332] {CVE-2026-48002}
    - ui/vnc: fix OOB write in VNC stats array (Daniel P. Berrange) [Orabug: 39447332] {CVE-2026-48002}
    - lsi53c895a: keep a reference to the device while SCRIPTS execute (Paolo Bonzini) [Orabug: 37517793]     {CVE-2024-6519}
    - hw/scsi/lsi53c895a: fix memory leak in lsi_scsi_realize() (Zheng Huang) [Orabug: 37517793]     {CVE-2024-6519}
    - hw/scsi/lsi53c895a: bump instruction limit in scripts processing to fix regression (Fiona Ebner)     [Orabug: 37517793] {CVE-2024-6519}
    - hw/scsi/lsi53c895a: add timer to scripts processing (Sven Schnelle) [Orabug: 37517793] {CVE-2024-6519}
    - virtio-scsi: pass the same cdb_size to virtio_scsi_pop_req and virtio_scsi_handle_cmd_req_prepare (Paolo     Bonzini) [Orabug: 39414097] {CVE-2026-5763}
    - softmmu: Support concurrent bounce buffers (Mattias Nissler) [Orabug: 37509310] {CVE-2024-8612}
    - system/physmem: Per-AddressSpace bounce buffering (Mattias Nissler) [Orabug: 37509310] {CVE-2024-8612}
    - system/physmem: Propagate AddressSpace to MapClient helpers (Mattias Nissler) [Orabug: 37509310]     {CVE-2024-8612}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3866 advisory.

    In QEMU's VNC server implementation (ui/vnc.c), the set_pixel_format() function does not properly validate     the red_max, green_max, and blue_max fields from a client'sSetPixelFormat message. These fields are     received as 16-bit values but are stored internally as uint8_t. A malicious VNC client can send a max     value above 255 (e.g., 0x0100) whichpasses the existing non-zero validation check but silently truncates     to 0 upon assignment, leading to a division by zero in the Tight PNG palette encoding path. This allows a     remoteattacker to crash the QEMU process, resulting in a denial of service for all guests served by that     QEMU instance. Fixed in QEMU v11.0.3 and v10.0.12. (CVE-2026-15578)

    In QEMU's USB redirection (usbredir) implementation, a use-after-free vulnerability exists in the     usbredir_buffered_bulk_packet() function in hw/usb/redirect.c. When processing amulti-fragment buffered     bulk packet that is split into max-packet-size chunks, only the final fragment owns the shared parser     memory allocation (via free_on_destroy). If bufp_alloc()drops the final fragment due to queue overflow, it     frees the backing buffer while earlier fragments already queued still hold interior pointers into it.
    Subsequent guest bulk-INtransfers then read from freed heap memory. A malicious or compromised USB device     (or a crafted usbredir stream) could trigger this condition, potentially leading to informationdisclosure     from heap memory or a QEMU process crash (denial of service). This vulnerability has existed since QEMU     v1.4.0-rc0 and is fixed in v11.0.3 and v10.0.12. (CVE-2026-15705)

    Incorrect calculation of the boundary condition when tracking lossy rectangles in the worker thread will     result in an OOB write which can corrupt further worker state, and/or trigger any guard pages that may lie     beyond the VncWorker struct. This can be triggered through careful choice of the display resolution in the     guest OS by an unprivileged user. (CVE-2026-48002)

    Incorrect loop bounds in vnc_update_freq result in iterating past the last row and past the last column in     the VNC stats array. With suitably chosen dimensions this could be a OOB read that accesses memory beyond     the VncDisplay struct that the stats array is embedded in.

    Should this hit a guard page, it could trigger a guest crash. If it does not, then the VNC frequency stats     will be updated with garbage. (CVE-2026-48003)

    In QEMU's VNC server implementation (ui/vnc.c), the vnc_refresh_lossy_rect() function contains an out-of-     bounds write vulnerability when marking dirty bitmap rows during lossy tilerefresh. The function     unconditionally marks a full VNC_STAT_RECT (64) rows of the dirty bitmap for each tile. When the display     height is not a multiple of 64 pixels, the last tilerow is a partial tile and the loop writes past the end     of the vs->dirty[VNC_MAX_HEIGHT] array. For example, with a 2160-pixel-high display, the last stat tile     starts at y=2112 andthe 64-row loop writes rows 2112-2175, overflowing 16 rows (640 bytes) past the dirty     bitmap into subsequent VncState fields. This heap buffer overflow could potentially be exploitedby a     malicious VNC client that negotiates a specific display resolution to corrupt QEMU process memory, leading     to denial of service or possibly arbitrary code execution. Fixed inQEMU v11.0.3 and v10.0.12.
    (CVE-2026-61475)

    In QEMU's USB redirection (usbredir) implementation (hw/usb/redirect.c), a malicious usbredir peer can     send an ep_info message that resets max_packet_size to 0 after bulk receivinghas already started. This     leads to multiple exploitable conditions: (1) an infinite loop in usbredir_buffered_bulk_packet() where     the splitting loop increments by max_packet_size (0) and never progresses, (2) a SIGFPE (floating point     exception) in usbredir_buffered_bulk_in_complete_ftdi() from a modulo-by-zero operation, and (3) a SIGFPE     in usbredir_handle_buffered_bulk_in_data() from a division-by-zero when computing bytes_per_transfer. A     malicious USB redirection peer can exploit this to crash the QEMU process (denial of service) orcause it     to hang indefinitely. Fixed in QEMU v11.0.3 and v10.0.12. (CVE-2026-63319)

    In QEMU's 9pfs (virtio-9p) implementation, the TXATTRCREATE and TXATTRWALK request handlers do not limit     the number of simultaneously open xattr FIDs. Each xattr FID allocates ahost memory buffer for the     extended attribute value. A malicious privileged guest user with direct 9p server access can exploit this     by repeatedly creating xattr FIDs without closingthem, leading to unbounded host memory consumption and     eventual host memory exhaustion (denial of service). This vulnerability has existed since QEMU v0.14.0-rc0     and is fixed inv11.0.3 and v10.0.12. (CVE-2026-8348)

    An out-of-bounds heap read and integer underflow in the TCP urgent data handling (sosendoob) in     freedesktop.org libslirp version before v4.9.2 on hypervisor host environments (e.g., QEMU) allows a     privileged guest VM attacker (root or CAP_NET_RAW) to leak gigabytes of sensitive host-process heap memory     via sending crafted TCP segments with manipulated URG flags and urgent pointers (ti_urp). (CVE-2026-9539)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In QEMU's VNC server implementation (ui/vnc.c), the set_pixel_format() function does not properly validate     the red_max, green_max, and blue_max fields from a client'sSetPixelFormat message. These fields are     received as 16-bit values but are stored internally as uint8_t. A malicious VNC client can send a max     value above 255 (e.g., 0x0100) whichpasses the existing non-zero validation check but silently truncates     to 0 upon assignment, leading to a division by zero in the Tight PNG palette encoding path. This allows a     remoteattacker to crash the QEMU process, resulting in a denial of service for all guests served by that     QEMU instance. Fixed in QEMU v11.0.3 and v10.0.12. (CVE-2026-15578)  In QEMU's USB redirection (usbredir)     implementation, a use-after-free vulnerability exists in the usbredir_buffered_bulk_packet() function in     hw/usb/redirect.c. When processing amulti-fragment buffered bulk packet that is split into max-packet-size     chunks, only the final fragment owns the shared parser memory allocation (via free_on_destroy). If     bufp_alloc()drops the final fragment due to queue overflow, it frees the backing buffer while earlier     fragments already queued still hold interior pointers into it. Subsequent guest bulk-INtransfers then read     from freed heap memory. A malicious or compromised USB device (or a crafted usbredir stream) could trigger     this condition, potentially leading to informationdisclosure from heap memory or a QEMU process crash     (denial of service). This vulnerability has existed since QEMU v1.4.0-rc0 and is fixed in v11.0.3 and     v10.0.12. (CVE-2026-15705)  Incorrect calculation of the boundary condition when tracking lossy rectangles     in the worker thread will result in an OOB write which can corrupt further worker state, and/or trigger     any guard pages that may lie beyond the VncWorker struct. This can be triggered through careful choice of     the display resolution in the guest OS by an unprivileged user. (CVE-2026-48002)  Incorrect loop bounds in     vnc_update_freq result in iterating past the last row and past the last column in the VNC stats array.
    With suitably chosen dimensions this could be a OOB read that accesses memory beyond the VncDisplay struct     that the stats array is embedded in.  Should this hit a guard page, it could trigger a guest crash. If it     does not, then the VNC frequency stats will be updated with garbage. (CVE-2026-48003)  In QEMU's VNC     server implementation (ui/vnc.c), the vnc_refresh_lossy_rect() function contains an out-of-bounds write     vulnerability when marking dirty bitmap rows during lossy tilerefresh. The function unconditionally marks     a full VNC_STAT_RECT (64) rows of the dirty bitmap for each tile. When the display height is not a     multiple of 64 pixels, the last tilerow is a partial tile and the loop writes past the end of the     vs->dirty[VNC_MAX_HEIGHT] array. For example, with a 2160-pixel-high display, the last stat tile starts at     y=2112 andthe 64-row loop writes rows 2112-2175, overflowing 16 rows (640 bytes) past the dirty bitmap     into subsequent VncState fields. This heap buffer overflow could potentially be exploitedby a malicious     VNC client that negotiates a specific display resolution to corrupt QEMU process memory, leading to denial     of service or possibly arbitrary code execution. Fixed inQEMU v11.0.3 and v10.0.12. (CVE-2026-61475)  In     QEMU's USB redirection (usbredir) implementation (hw/usb/redirect.c), a malicious usbredir peer can send     an ep_info message that resets max_packet_size to 0 after bulk receivinghas already started. This leads to     multiple exploitable conditions: (1) an infinite loop in usbredir_buffered_bulk_packet() where the     splitting loop increments by max_packet_size (0) and never progresses, (2) a SIGFPE (floating point     exception) in usbredir_buffered_bulk_in_complete_ftdi() from a modulo-by-zero operation, and (3) a SIGFPE     in usbredir_handle_buffered_bulk_in_data() from a division-by-zero when computing bytes_per_transfer. A     malicious USB redirection peer can exploit this to crash the QEMU process (denial of service) orcause it     to hang indefinitely. Fixed in QEMU v11.0.3 and v10.0.12. (CVE-2026-63319)  In QEMU's 9pfs (virtio-9p)     implementation, the TXATTRCREATE and TXATTRWALK request handlers do not limit the number of simultaneously     open xattr FIDs. Each xattr FID allocates ahost memory buffer for the extended attribute value. A     malicious privileged guest user with direct 9p server access can exploit this by repeatedly creating xattr     FIDs without closingthem, leading to unbounded host memory consumption and eventual host memory exhaustion     (denial of service). This vulnerability has existed since QEMU v0.14.0-rc0 and is fixed inv11.0.3 and     v10.0.12. (CVE-2026-8348)  An out-of-bounds heap read and integer underflow in the TCP urgent data     handling (sosendoob) in freedesktop.org libslirp version before v4.9.2 on hypervisor host environments     (e.g., QEMU) allows a privileged guest VM attacker (root or CAP_NET_RAW) to leak gigabytes of sensitive     host-process heap memory via sending crafted TCP segments with manipulated URG flags and urgent pointers     (ti_urp). (CVE-2026-9539) (CVE-2026-48003)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50337 advisory.

    - Limit recursion in ri-records (CVE-2021-3622)       resolves: rhbz#1976194
    - Bounds check for block exceeding page length (CVE-2021-3504)       resolves: rhbz#1950501
    - Fixes: CVE-2022-40284
    - Fixes: CVE-2021-46790, CVE-2022-30783, CVE-2022-30784, CVE-2022-30785,       CVE-2022-30786, CVE-2022-30787, CVE-2022-30788, CVE-2022-30789       resolves: rhbz#2127240 rhbz#2127248       (also: 2127233 2127234 2127241 2127249 2127255 2127256 2127262 2127263)
    - Fixes: CVE-2021-33285, CVE-2021-33286, CVE-2021-33287, CVE-2021-33289,       CVE-2021-35266, CVE-2021-35267, CVE-2021-35268, CVE-2021-35269,       CVE-2021-39251, CVE-2021-39252, CVE-2021-39253, CVE-2021-39254       resolves: rhbz#2004490
    - Fix for CVE-2019-9755       (heap-based buffer overflow leads to local root privilege escalation)       resolves: rhbz#1698503
    - Fix CVE-2024-7383 NBD server improper certificate validation       resolves: RHEL-52728
    - Fix CVE-2022-0485: Fail nbdcopy if NBD read or write fails       resolves: rhbz#2045718
    - Contains fix for NBD Protocol Downgrade Attack (CVE-2019-14842).
    - Fix CVE-2025-49133       Resolves: RHEL-96251
    - Backport 'tpm2: Check size of buffer before accessing it' (CVE-2023-1017 & CVE-2023-1018)       Resolves: rhbz#2173964       Resolves: rhbz#2173970
    - Fix CVE-2021-3746 libtpms: out-of-bounds access via specially crafted TPM 2 command packets       Resolves: rhbz#1999307
    - Fix CVE-2021-3623: out-of-bounds access when trying to resume the state of the vTPM       Fixes: rhbz#1976816
    - Fix CVE-2021-3716 NBD_OPT_STRUCTURED_REPLY injection on STARTTLS       resolves: rhbz#1994915
    - ui: fix validation of VNC extended clipboard data length (Heechan Kang) [Orabug: 39442988]     {CVE-2026-8343}
    - ui/vnc: fix OOB read updating VNC update frequency stats (Daniel P. Berrange) [Orabug: 39447326]     {CVE-2026-48003}
    - ui/vnc: fix OOB write in lossy rect worker code (Daniel P. Berrange) [Orabug: 39447332] {CVE-2026-48002}
    - ui/vnc: fix OOB write in VNC stats array (Daniel P. Berrange) [Orabug: 39447332] {CVE-2026-48002}
    - lsi53c895a: keep a reference to the device while SCRIPTS execute (Paolo Bonzini) [Orabug: 37517793]     {CVE-2024-6519}
    - hw/scsi/lsi53c895a: fix memory leak in lsi_scsi_realize() (Zheng Huang) [Orabug: 37517793]     {CVE-2024-6519}
    - hw/scsi/lsi53c895a: bump instruction limit in scripts processing to fix regression (Fiona Ebner)     [Orabug: 37517793] {CVE-2024-6519}
    - hw/scsi/lsi53c895a: add timer to scripts processing (Sven Schnelle) [Orabug: 37517793] {CVE-2024-6519}
    - virtio-scsi: pass the same cdb_size to virtio_scsi_pop_req and virtio_scsi_handle_cmd_req_prepare (Paolo     Bonzini) [Orabug: 39414097] {CVE-2026-5763}
    - softmmu: Support concurrent bounce buffers (Mattias Nissler) [Orabug: 37509310] {CVE-2024-8612}
    - system/physmem: Per-AddressSpace bounce buffering (Mattias Nissler) [Orabug: 37509310] {CVE-2024-8612}
    - system/physmem: Propagate AddressSpace to MapClient helpers (Mattias Nissler) [Orabug: 37509310]     {CVE-2024-8612}
    - Document CVEs (Mark Kanda) {CVE-2025-54566} {CVE-2025-54567} {CVE-2025-8860} {CVE-2026-0665}     {CVE-2026-3886}
    - hw/usb/hcd-ohci: check for MPS=0 to avoid infinite loop (Jenny Guanni Qu) [Orabug: 39160764]     {CVE-2026-3890}
    - hyperv/syndbg: check length returned by cpu_physical_memory_map() (Paolo Bonzini) [Orabug: 39160749]     {CVE-2026-3842}
    - block/vmdk: fix OOB read in vmdk_read_extent() (Halil Oktay) [Orabug: 39160776] {CVE-2026-2243}
    - cryptodev-builtin: Limit the maximum size (zhenwei pi) [Orabug: 39173335] {CVE-2025-14876}
    - hw/virtio/virtio-crypto: verify asym request size (zhenwei pi) [Orabug: 39173335] {CVE-2025-14876}
    - io: fix use after free in websocket handshake code (Daniel P. Berrange) [Orabug: 38687831]     {CVE-2025-11234}

    seabios
    - Add fix for CVE-2022-23645.
      Resolves: rhbz#2056517
    - Update to 0.4.2, to address potential symlink vulnerabilities (CVE-2020-28407).
      Resolves: rhbz#1906043
    - Fix CVE-2022-2211 Denial of Service in --key parameter       resolves: rhbz#2102720

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
465729	Echo: qemu: security update to 1:10.0.11+ds-0+deb13u1	Tenable Cloud Security	Echo Local Security Checks	Local	medium
465729	Echo: qemu: security update to 1:10.0.11+ds-0+deb13u1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
339119	Oracle Linux 9 : qemu-kvm (ELSA-2026-500220)	Nessus	Oracle Linux Local Security Checks	Local	high
337242	Amazon Linux 2 : qemu, --advisory ALAS2-2026-3866 (ALAS-2026-3866)	Nessus	Amazon Linux Local Security Checks	Local	medium
323504	Linux Distros Unpatched Vulnerability : CVE-2026-48003	Nessus	Misc.	Local	critical
322307	Oracle Linux 8 : virt:kvm_utils3 (ELSA-2026-50337)	Nessus	Oracle Linux Local Security Checks	Local	high

Detections

Analytics

CVE-2026-48003

medium

Tenable Plugins

medium

medium

high

medium

critical

high