CVE-2013-4544

hw/net/vmxnet3.c in QEMU 2.0.0-rc0, 1.7.1, and earlier allows local guest users to cause a denial...

4.9 MediumFix available

hw/net/vmxnet3.c in QEMU 2.0.0-rc0, 1.7.1, and earlier allows local guest users to cause a denial of service or possibly execute arbitrary code via vectors related to (1) RX or (2) TX queue numbers or (3) interrupt indices. NOTE: some of these details are obtained from third party information.

Exploit likelihood

0.72%Down 1.5 points since Feb 4, 2022

What each source reports

NVD Score used 4.9

Record: CVE-2013-4544
CVSS 2.0: 4.9 MediumAV:A/AC:M/Au:S/C:P/I:P/A:P
Weakness: CWE-20
Updated: 2026-11-02

CVE List No score

Record: CVE-2013-4544
Updated: 2026-11-02

EUVDEUVD-2013-4403 No score

Record: EUVD-2013-4403
Updated: 2026-11-03

GitHub AdvisoriesGHSA-xxjj-3mqq-qmc5 No score

hw/net/vmxnet3.c in QEMU 2.0.0-rc0, 1.7.1, and earlier allows local guest users to cause a denial...

Record: GHSA-xxjj-3mqq-qmc5
Weakness: CWE-20
Updated: 2026-11-02

OSVBELL-CVE-2013-4544 4.9

CVE-2013-4544 does not affect BellSoft software

Record: BELL-CVE-2013-4544
CVSS 2.0: 4.9 MediumAV:A/AC:M/Au:S/C:P/I:P/A:P
Updated: 2026-11-02

OSV No score

Record: CVE-2013-4544
Updated: 2026-11-02

Show 4 moreShow less

OSVDEBIAN-CVE-2013-4544 No score

Record: DEBIAN-CVE-2013-4544
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10233-1 No score

qemu-2.6.1-1.5 on GA media

These are all security issues fixed in the qemu-2.6.1-1.5 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10233-1
Updated: 2026-11-02

OSVUBUNTU-CVE-2013-4544 No score

Record: UBUNTU-CVE-2013-4544
Updated: 2026-11-02

OSVUSN-2182-1 No score

qemu, qemu-kvm vulnerabilities

Michael S. Tsirkin discovered that QEMU incorrectly handled vmxnet3 devices. A local guest could possibly use this issue to cause a denial of service, or possibly execute arbitrary code on the host. This issue only applied to Ubuntu 13.10 and Ubuntu 14.04 LTS. (CVE-2013-4544)

Michael S. Tsirkin discovered that QEMU incorrectly handled virtio-net MAC addresses. A local guest could possibly use this issue to cause a denial of service, or possibly execute arbitrary code on the host. (CVE-2014-0150)

Benoît Canet discovered that QEMU incorrectly handled SMART self-tests. A local guest could possibly use this issue to cause a denial of service, or possibly execute arbitrary code on the host. (CVE-2014-2894)

Record: USN-2182-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`qemu` Debian:12	before 2.0.0+dfsg-1	2.0.0+dfsg-1
`qemu` Debian:13	before 2.0.0+dfsg-1	2.0.0+dfsg-1
`qemu` Debian:14	before 2.0.0+dfsg-1	2.0.0+dfsg-1
`qemu` Ubuntu:14.04:LTS	before 2.0.0~rc1+dfsg-0ubuntu3.1, plus listed versions 1.5.0+dfsg-3ubuntu51.5.0+dfsg-3ubuntu61.6.0+dfsg-2ubuntu11.6.0+dfsg-2ubuntu21.6.0+dfsg-2ubuntu3 Show 20 moreShow less 1.6.0+dfsg-2ubuntu41.7.0+dfsg-2ubuntu11.7.0+dfsg-2ubuntu21.7.0+dfsg-2ubuntu31.7.0+dfsg-2ubuntu41.7.0+dfsg-2ubuntu51.7.0+dfsg-2ubuntu71.7.0+dfsg-2ubuntu81.7.0+dfsg-2ubuntu91.7.0+dfsg-3ubuntu1~ppa11.7.0+dfsg-3ubuntu11.7.0+dfsg-3ubuntu21.7.0+dfsg-3ubuntu31.7.0+dfsg-3ubuntu41.7.0+dfsg-3ubuntu51.7.0+dfsg-3ubuntu61.7.0+dfsg-3ubuntu72.0.0~rc1+dfsg-0ubuntu12.0.0~rc1+dfsg-0ubuntu22.0.0~rc1+dfsg-0ubuntu3	2.0.0~rc1+dfsg-0ubuntu3.1
`qemu` Ubuntu:14.04:LTS From an advisory covering 3 CVEs	before 2.0.0~rc1+dfsg-0ubuntu3.1, plus listed versions 1.5.0+dfsg-3ubuntu51.5.0+dfsg-3ubuntu61.6.0+dfsg-2ubuntu11.6.0+dfsg-2ubuntu21.6.0+dfsg-2ubuntu3 Show 20 moreShow less 1.6.0+dfsg-2ubuntu41.7.0+dfsg-2ubuntu11.7.0+dfsg-2ubuntu21.7.0+dfsg-2ubuntu31.7.0+dfsg-2ubuntu41.7.0+dfsg-2ubuntu51.7.0+dfsg-2ubuntu71.7.0+dfsg-2ubuntu81.7.0+dfsg-2ubuntu91.7.0+dfsg-3ubuntu1~ppa11.7.0+dfsg-3ubuntu11.7.0+dfsg-3ubuntu21.7.0+dfsg-3ubuntu31.7.0+dfsg-3ubuntu41.7.0+dfsg-3ubuntu51.7.0+dfsg-3ubuntu61.7.0+dfsg-3ubuntu72.0.0~rc1+dfsg-0ubuntu12.0.0~rc1+dfsg-0ubuntu22.0.0~rc1+dfsg-0ubuntu3	2.0.0~rc1+dfsg-0ubuntu3.1
`qemu` openSUSE:Tumbleweed From an advisory covering 53 CVEs	before 2.6.1-1.5	2.6.1-1.5

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-4544 is a medium vulnerability (CVSS 4.9) in Qemu, published April 11, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.72%, the 54th percentile. Fixed in qemu 2.0.0+dfsg-1.

References

Show 69 moreShow less