CVE-2019-12928
The QMP migrate command in QEMU version 4.0.0 and earlier is vulnerable to OS command injection,...
The QMP migrate command in QEMU version 4.0.0 and earlier is vulnerable to OS command injection, which allows the remote attacker to achieve code execution, denial of service, or information disclosure by sending a crafted QMP command to the listening server. Note: This has been disputed as a non-issue since QEMU's -qmp interface is meant to be used by trusted users. If one is able to access this interface via a tcp socket open to the internet, then it is an insecure configuration issue
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The QMP migrate command in QEMU version 4.0.0 and earlier is vulnerable to OS command injection, which allows the remote attacker to achieve code execution, denial of service, or information disclosure by sending a crafted QMP command to the listening server. Note: This has been disputed as a non-issue since QEMU's -qmp interface is meant to be used by trusted users. If one is able to access this interface via a tcp socket open to the internet, then it is an insecure configuration issue
- Record
CVE-2019-12928- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-78, CWE-668
- Updated
- 2026-11-02
CVE List No score
The QMP migrate command in QEMU version 4.0.0 and earlier is vulnerable to OS command injection, which allows the remote attacker to achieve code execution, denial of service, or information disclosure by sending a crafted QMP command to the listening server. Note: This has been disputed as a non-issue since QEMU's -qmp interface is meant to be used by trusted users. If one is able to access this interface via a tcp socket open to the internet, then it is an insecure configuration issue
- Record
CVE-2019-12928- Updated
- 2026-11-02
EUVDEUVD-2019-4505 No score
The QMP migrate command in QEMU version 4.0.0 and earlier is vulnerable to OS command injection, which allows the remote attacker to achieve code execution, denial of service, or information disclosure by sending a crafted QMP command to the listening server. Note: This has been disputed as a non-issue since QEMU's -qmp interface is meant to be used by trusted users. If one is able to access this interface via a tcp socket open to the internet, then it is an insecure configuration issue
- Record
EUVD-2019-4505- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pwcf-p9qx-3948
The QMP migrate command in QEMU version 4.0.0 and earlier is vulnerable to OS command injection,...
The QMP migrate command in QEMU version 4.0.0 and earlier is vulnerable to OS command injection, which allows the remote attacker to achieve code execution, denial of service, or information disclosure by sending a crafted QMP command to the listening server.
- Record
GHSA-pwcf-p9qx-3948- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-668
- Updated
- 2026-11-02
OSVBELL-CVE-2019-12928
CVE-2019-12928 does not affect BellSoft software
- Record
BELL-CVE-2019-12928- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
The QMP migrate command in QEMU version 4.0.0 and earlier is vulnerable to OS command injection, which allows the remote attacker to achieve code execution, denial of service, or information disclosure by sending a crafted QMP command to the listening server. Note: This has been disputed as a non-issue since QEMU's -qmp interface is meant to be used by trusted users. If one is able to access this interface via a tcp socket open to the internet, then it is an insecure configuration issue
- Record
CVE-2019-12928- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-12928
The QMP migrate command in QEMU version 4.0.0 and earlier is vulnerable to OS command injection, which allows the remote attacker to achieve code execution, denial of service, or information disclosure by sending a crafted QMP command to the listening server. Note: This has been disputed as a non-issue since QEMU's -qmp interface is meant to be used by trusted users. If one is able to access this interface via a tcp socket open to the internet, then it is an insecure configuration issue
- Record
DEBIAN-CVE-2019-12928- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-12928
The QMP migrate command in QEMU version 4.0.0 and earlier is vulnerable to OS command injection, which allows the remote attacker to achieve code execution, denial of service, or information disclosure by sending a crafted QMP command to the listening server. Note: This has been disputed as a non-issue since QEMU's -qmp interface is meant to be used by trusted users. If one is able to access this interface via a tcp socket open to the internet, then it is an insecure configuration issue
- Record
UBUNTU-CVE-2019-12928- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
qemuDebian:12 |
All versions, plus listed versions 1:10.0.0+ds-11:10.0.0+ds-21:10.0.0+ds-2~bpo12+11:10.0.0+ds-2~bpo12+21:10.0.0~rc0+ds-1 Show 45 moreShow less1:10.0.0~rc0+ds-21:10.0.0~rc1+ds-11:10.0.0~rc1+ds-21:10.0.0~rc2+ds-11:10.0.0~rc2+ds-21:10.0.0~rc3+ds-11:10.0.0~rc3+ds-21:10.0.2+ds-11:10.0.2+ds-21:10.0.2+ds-2~bpo12+11:10.0.3+ds-11:10.0.3+ds-21:10.0.3+ds-31:10.0.3+ds-41:10.1.0+ds-11:10.1.0+ds-21:10.1.0+ds-31:10.1.0+ds-41:10.1.0+ds-51:10.1.0~rc0+ds-11:10.1.0~rc0+ds-21:10.1.0~rc0+ds-31:10.1.0~rc0+ds-41:10.1.0~rc1+ds-11:10.1.0~rc1+ds-1a1:10.1.0~rc1+ds-1b1:10.1.0~rc1+ds-21:10.1.0~rc1+ds-31:10.1.0~rc2+ds-11:10.1.0~rc3+ds-11:10.1.0~rc3+ds-21:10.1.1+ds-11:10.1.2+ds-11:10.1.2+ds-21:10.1.2+ds-31:10.1.3+ds-11:10.2.0+ds-11:10.2.0+ds-21:10.2.0~rc1+ds-11:10.2.1+ds-11:10.2.2+ds-11:11.0.0+ds-11:11.0.0+ds-21:11.0.0~rc0+ds-11:11.0.0~rc0+ds-2 |
None known |
qemuDebian:13 |
All versions, plus listed versions 1:10.0.10+ds-0+deb13u11:10.0.11+ds-0+deb13u11:10.0.13+ds-0+deb13u11:10.0.2+ds-21:10.0.2+ds-2+deb13u1 Show 45 moreShow less1:10.0.2+ds-2+deb13u1~bpo12+11:10.0.3+ds-0+deb13u11:10.0.3+ds-11:10.0.3+ds-21:10.0.3+ds-31:10.0.3+ds-41:10.0.6+ds-0+deb13u11:10.0.6+ds-0+deb13u21:10.0.7+ds-0+deb13u11:10.0.8+ds-0+deb13u11:10.1.0+ds-11:10.1.0+ds-21:10.1.0+ds-31:10.1.0+ds-41:10.1.0+ds-51:10.1.0~rc0+ds-11:10.1.0~rc0+ds-21:10.1.0~rc0+ds-31:10.1.0~rc0+ds-41:10.1.0~rc1+ds-11:10.1.0~rc1+ds-1a1:10.1.0~rc1+ds-1b1:10.1.0~rc1+ds-21:10.1.0~rc1+ds-31:10.1.0~rc2+ds-11:10.1.0~rc3+ds-11:10.1.0~rc3+ds-21:10.1.1+ds-11:10.1.2+ds-11:10.1.2+ds-21:10.1.2+ds-31:10.1.3+ds-11:10.2.0+ds-11:10.2.0+ds-21:10.2.0~rc1+ds-11:10.2.1+ds-11:10.2.2+ds-11:11.0.0+ds-11:11.0.0+ds-21:11.0.0~rc0+ds-11:11.0.0~rc0+ds-21:11.0.0~rc1+ds-11:11.0.0~rc1+ds-21:11.0.0~rc1+ds-31:11.0.0~rc2+ds-1 |
None known |
qemuDebian:14 |
All versions, plus listed versions 1:10.0.2+ds-21:10.0.3+ds-11:10.0.3+ds-21:10.0.3+ds-31:10.0.3+ds-4 Show 45 moreShow less1:10.1.0+ds-11:10.1.0+ds-21:10.1.0+ds-31:10.1.0+ds-41:10.1.0+ds-51:10.1.0~rc0+ds-11:10.1.0~rc0+ds-21:10.1.0~rc0+ds-31:10.1.0~rc0+ds-41:10.1.0~rc1+ds-11:10.1.0~rc1+ds-1a1:10.1.0~rc1+ds-1b1:10.1.0~rc1+ds-21:10.1.0~rc1+ds-31:10.1.0~rc2+ds-11:10.1.0~rc3+ds-11:10.1.0~rc3+ds-21:10.1.1+ds-11:10.1.2+ds-11:10.1.2+ds-21:10.1.2+ds-31:10.1.3+ds-11:10.2.0+ds-11:10.2.0+ds-21:10.2.0~rc1+ds-11:10.2.1+ds-11:10.2.2+ds-11:11.0.0+ds-11:11.0.0+ds-21:11.0.0~rc0+ds-11:11.0.0~rc0+ds-21:11.0.0~rc1+ds-11:11.0.0~rc1+ds-21:11.0.0~rc1+ds-31:11.0.0~rc2+ds-11:11.0.0~rc2+ds-21:11.0.0~rc3+ds-11:11.0.1+ds-11:11.0.2+ds-11:11.0.2+ds-21:11.0.2+ds-2~bpo13+11:11.0.3+ds-11:11.0.3+ds-21:11.1.0+ds-11:11.1.0+ds-2 |
None known |
qemuUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 1.5.0+dfsg-3ubuntu51.5.0+dfsg-3ubuntu61.6.0+dfsg-2ubuntu11.6.0+dfsg-2ubuntu21.6.0+dfsg-2ubuntu3 Show 45 moreShow less1.6.0+dfsg-2ubuntu41.7.0+dfsg-2ubuntu11.7.0+dfsg-2ubuntu21.7.0+dfsg-2ubuntu31.7.0+dfsg-2ubuntu41.7.0+dfsg-2ubuntu51.7.0+dfsg-2ubuntu71.7.0+dfsg-2ubuntu81.7.0+dfsg-2ubuntu91.7.0+dfsg-3ubuntu1~ppa11.7.0+dfsg-3ubuntu11.7.0+dfsg-3ubuntu21.7.0+dfsg-3ubuntu31.7.0+dfsg-3ubuntu41.7.0+dfsg-3ubuntu51.7.0+dfsg-3ubuntu61.7.0+dfsg-3ubuntu72.0.0~rc1+dfsg-0ubuntu12.0.0~rc1+dfsg-0ubuntu22.0.0~rc1+dfsg-0ubuntu32.0.0~rc1+dfsg-0ubuntu3.12.0.0+dfsg-2ubuntu12.0.0+dfsg-2ubuntu1.12.0.0+dfsg-2ubuntu1.22.0.0+dfsg-2ubuntu1.32.0.0+dfsg-2ubuntu1.52.0.0+dfsg-2ubuntu1.62.0.0+dfsg-2ubuntu1.72.0.0+dfsg-2ubuntu1.82.0.0+dfsg-2ubuntu1.92.0.0+dfsg-2ubuntu1.102.0.0+dfsg-2ubuntu1.112.0.0+dfsg-2ubuntu1.132.0.0+dfsg-2ubuntu1.142.0.0+dfsg-2ubuntu1.152.0.0+dfsg-2ubuntu1.162.0.0+dfsg-2ubuntu1.172.0.0+dfsg-2ubuntu1.182.0.0+dfsg-2ubuntu1.192.0.0+dfsg-2ubuntu1.202.0.0+dfsg-2ubuntu1.212.0.0+dfsg-2ubuntu1.222.0.0+dfsg-2ubuntu1.242.0.0+dfsg-2ubuntu1.252.0.0+dfsg-2ubuntu1.26 |
None known |
qemuUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1:2.3+dfsg-5ubuntu91:2.3+dfsg-5ubuntu101:2.4+dfsg-4ubuntu11:2.4+dfsg-4ubuntu21:2.4+dfsg-4ubuntu3 Show 45 moreShow less1:2.4+dfsg-5ubuntu31:2.5+dfsg-1ubuntu21:2.5+dfsg-1ubuntu31:2.5+dfsg-1ubuntu41:2.5+dfsg-1ubuntu51:2.5+dfsg-5ubuntu11:2.5+dfsg-5ubuntu21:2.5+dfsg-5ubuntu41:2.5+dfsg-5ubuntu61:2.5+dfsg-5ubuntu71:2.5+dfsg-5ubuntu101:2.5+dfsg-5ubuntu10.11:2.5+dfsg-5ubuntu10.21:2.5+dfsg-5ubuntu10.31:2.5+dfsg-5ubuntu10.41:2.5+dfsg-5ubuntu10.51:2.5+dfsg-5ubuntu10.61:2.5+dfsg-5ubuntu10.71:2.5+dfsg-5ubuntu10.81:2.5+dfsg-5ubuntu10.91:2.5+dfsg-5ubuntu10.101:2.5+dfsg-5ubuntu10.111:2.5+dfsg-5ubuntu10.131:2.5+dfsg-5ubuntu10.141:2.5+dfsg-5ubuntu10.151:2.5+dfsg-5ubuntu10.161:2.5+dfsg-5ubuntu10.201:2.5+dfsg-5ubuntu10.211:2.5+dfsg-5ubuntu10.221:2.5+dfsg-5ubuntu10.241:2.5+dfsg-5ubuntu10.251:2.5+dfsg-5ubuntu10.261:2.5+dfsg-5ubuntu10.281:2.5+dfsg-5ubuntu10.291:2.5+dfsg-5ubuntu10.301:2.5+dfsg-5ubuntu10.311:2.5+dfsg-5ubuntu10.321:2.5+dfsg-5ubuntu10.331:2.5+dfsg-5ubuntu10.341:2.5+dfsg-5ubuntu10.351:2.5+dfsg-5ubuntu10.361:2.5+dfsg-5ubuntu10.371:2.5+dfsg-5ubuntu10.381:2.5+dfsg-5ubuntu10.391:2.5+dfsg-5ubuntu10.40 |
None known |
qemuUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1:2.10+dfsg-0ubuntu31:2.10+dfsg-0ubuntu41:2.10+dfsg-0ubuntu51:2.11+dfsg-1ubuntu11:2.11+dfsg-1ubuntu2 Show 45 moreShow less1:2.11+dfsg-1ubuntu41:2.11+dfsg-1ubuntu51:2.11+dfsg-1ubuntu61:2.11+dfsg-1ubuntu71:2.11+dfsg-1ubuntu7.11:2.11+dfsg-1ubuntu7.21:2.11+dfsg-1ubuntu7.31:2.11+dfsg-1ubuntu7.41:2.11+dfsg-1ubuntu7.51:2.11+dfsg-1ubuntu7.61:2.11+dfsg-1ubuntu7.71:2.11+dfsg-1ubuntu7.81:2.11+dfsg-1ubuntu7.91:2.11+dfsg-1ubuntu7.101:2.11+dfsg-1ubuntu7.121:2.11+dfsg-1ubuntu7.131:2.11+dfsg-1ubuntu7.141:2.11+dfsg-1ubuntu7.151:2.11+dfsg-1ubuntu7.171:2.11+dfsg-1ubuntu7.181:2.11+dfsg-1ubuntu7.191:2.11+dfsg-1ubuntu7.201:2.11+dfsg-1ubuntu7.211:2.11+dfsg-1ubuntu7.221:2.11+dfsg-1ubuntu7.231:2.11+dfsg-1ubuntu7.251:2.11+dfsg-1ubuntu7.261:2.11+dfsg-1ubuntu7.271:2.11+dfsg-1ubuntu7.281:2.11+dfsg-1ubuntu7.291:2.11+dfsg-1ubuntu7.311:2.11+dfsg-1ubuntu7.321:2.11+dfsg-1ubuntu7.331:2.11+dfsg-1ubuntu7.341:2.11+dfsg-1ubuntu7.351:2.11+dfsg-1ubuntu7.361:2.11+dfsg-1ubuntu7.371:2.11+dfsg-1ubuntu7.381:2.11+dfsg-1ubuntu7.391:2.11+dfsg-1ubuntu7.401:2.11+dfsg-1ubuntu7.411:2.11+dfsg-1ubuntu7.421:2.11+dfsg-1ubuntu7.42+esm11:2.11+dfsg-1ubuntu7.42+esm21:2.11+dfsg-1ubuntu7.42+esm5 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | QEMU Monitor HMP 'migrate' Command Execution | 2011-12-02 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, Metasploit, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-12928 is a critical vulnerability (CVSS 9.8) in Qemu, published June 24, 2019. Its validity is disputed. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 23.0%, the 97th percentile.
References
fakhrizulkifli.github.io/posts/2019/06/05/CVE-2019-12928
nvd.nist.gov/vuln/detail/CVE-2019-12928
github.com/advisories/GHSA-pwcf-p9qx-3948
docs.bell-sw.com/security/cves/CVE-2019-12928
security-tracker.debian.org/tracker/CVE-2019-12928
ubuntu.com/security/CVE-2019-12928
cve.org/CVERecord?id=CVE-2019-12928
Left out here: 211 versions. The JSON record has them.