CVE-2020-13791
hw/pci/pci.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access by providing...
hw/pci/pci.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access by providing an address near the end of the PCI configuration space.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
hw/pci/pci.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access by providing an address near the end of the PCI configuration space.
- Record
CVE-2020-13791- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE List No score
hw/pci/pci.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access by providing an address near the end of the PCI configuration space.
- Record
CVE-2020-13791- Updated
- 2026-11-02
EUVDEUVD-2020-6007 No score
hw/pci/pci.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access by providing an address near the end of the PCI configuration space.
- Record
EUVD-2020-6007- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9j9x-v7hw-3v8f No score
hw/pci/pci.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access by providing...
hw/pci/pci.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access by providing an address near the end of the PCI configuration space.
- Record
GHSA-9j9x-v7hw-3v8f- Weakness
- CWE-125
- Updated
- 2026-11-02
OSVALPINE-CVE-2020-13791
hw/pci/pci.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access by providing an address near the end of the PCI configuration space.
- Record
ALPINE-CVE-2020-13791- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSVBELL-CVE-2020-13791
CVE-2020-13791 does not affect BellSoft software
- Record
BELL-CVE-2020-13791- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSV
hw/pci/pci.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access by providing an address near the end of the PCI configuration space.
- Record
CVE-2020-13791- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-13791
hw/pci/pci.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access by providing an address near the end of the PCI configuration space.
- Record
DEBIAN-CVE-2020-13791- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2023-1654
qemu security update
QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.
Security Fix(es):
hw/pci/pci.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access by providing an address near the end of the PCI configuration space.(CVE-2020-13791)
An issue was discovered in TCG Accelerator in QEMU 4.2.0, allows local attackers to execute arbitrary code, escalate privileges, and cause a denial of service (DoS).(CVE-2020-24165)
- Record
OESA-2023-1654- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2023-1655
qemu security update
QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.
Security Fix(es):
hw/pci/pci.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access by providing an address near the end of the PCI configuration space.(CVE-2020-13791)
An issue was discovered in TCG Accelerator in QEMU 4.2.0, allows local attackers to execute arbitrary code, escalate privileges, and cause a denial of service (DoS).(CVE-2020-24165)
- Record
OESA-2023-1655- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-13791
hw/pci/pci.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access by providing an address near the end of the PCI configuration space.
- Record
UBUNTU-CVE-2020-13791- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
qemuAlpine:v3.16 |
before 5.0.0-r0 | 5.0.0-r0 |
qemuAlpine:v3.17 |
before 5.0.0-r0 | 5.0.0-r0 |
qemuAlpine:v3.18 |
before 5.0.0-r0 | 5.0.0-r0 |
qemuAlpine:v3.19 |
before 5.0.0-r0 | 5.0.0-r0 |
qemuAlpine:v3.20 |
before 5.0.0-r0 | 5.0.0-r0 |
qemuAlpine:v3.21 |
before 5.0.0-r0 | 5.0.0-r0 |
qemuAlpine:v3.22 |
before 5.0.0-r0 | 5.0.0-r0 |
qemuAlpine:v3.23 |
before 5.0.0-r0 | 5.0.0-r0 |
qemuAlpine:v3.24 |
before 5.0.0-r0 | 5.0.0-r0 |
qemuDebian:12 |
before 1:5.0-6 | 1:5.0-6 |
Show 12 moreShow less
| Package | Affected | Fixed |
|---|---|---|
qemuDebian:13 |
before 1:5.0-6 | 1:5.0-6 |
qemuDebian:14 |
before 1:5.0-6 | 1:5.0-6 |
qemuopenEuler:20.03-LTS-SP1 From an advisory covering 2 CVEs |
before 4.1.0-76.oe1 | 4.1.0-76.oe1 |
qemuopenEuler:20.03-LTS-SP3 From an advisory covering 2 CVEs |
before 4.1.0-80.oe1 | 4.1.0-80.oe1 |
qemuUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1:4.0+dfsg-0ubuntu91:4.0+dfsg-0ubuntu101:4.2-1ubuntu11:4.2-1ubuntu21:4.2-3ubuntu1 Show 35 moreShow less1:4.2-3ubuntu21:4.2-3ubuntu31:4.2-3ubuntu41:4.2-3ubuntu51:4.2-3ubuntu61:4.2-3ubuntu6.11:4.2-3ubuntu6.21:4.2-3ubuntu6.31:4.2-3ubuntu6.41:4.2-3ubuntu6.51:4.2-3ubuntu6.61:4.2-3ubuntu6.71:4.2-3ubuntu6.81:4.2-3ubuntu6.91:4.2-3ubuntu6.101:4.2-3ubuntu6.111:4.2-3ubuntu6.121:4.2-3ubuntu6.141:4.2-3ubuntu6.151:4.2-3ubuntu6.161:4.2-3ubuntu6.171:4.2-3ubuntu6.181:4.2-3ubuntu6.191:4.2-3ubuntu6.211:4.2-3ubuntu6.231:4.2-3ubuntu6.241:4.2-3ubuntu6.251:4.2-3ubuntu6.261:4.2-3ubuntu6.271:4.2-3ubuntu6.281:4.2-3ubuntu6.291:4.2-3ubuntu6.301:4.2-3ubuntu6.30+esm11:4.2-3ubuntu6.30+esm21:4.2-3ubuntu6.30+esm3 |
None known |
qemuUbuntu:22.04:LTS |
All versions, plus listed versions 1:6.0+dfsg-2expubuntu11:6.0+dfsg-2expubuntu21:6.0+dfsg-2expubuntu41:6.2+dfsg-2ubuntu51:6.2+dfsg-2ubuntu6 Show 30 moreShow less1:6.2+dfsg-2ubuntu6.11:6.2+dfsg-2ubuntu6.21:6.2+dfsg-2ubuntu6.31:6.2+dfsg-2ubuntu6.41:6.2+dfsg-2ubuntu6.51:6.2+dfsg-2ubuntu6.61:6.2+dfsg-2ubuntu6.71:6.2+dfsg-2ubuntu6.81:6.2+dfsg-2ubuntu6.91:6.2+dfsg-2ubuntu6.101:6.2+dfsg-2ubuntu6.111:6.2+dfsg-2ubuntu6.121:6.2+dfsg-2ubuntu6.131:6.2+dfsg-2ubuntu6.141:6.2+dfsg-2ubuntu6.151:6.2+dfsg-2ubuntu6.161:6.2+dfsg-2ubuntu6.171:6.2+dfsg-2ubuntu6.181:6.2+dfsg-2ubuntu6.191:6.2+dfsg-2ubuntu6.211:6.2+dfsg-2ubuntu6.221:6.2+dfsg-2ubuntu6.231:6.2+dfsg-2ubuntu6.241:6.2+dfsg-2ubuntu6.251:6.2+dfsg-2ubuntu6.261:6.2+dfsg-2ubuntu6.271:6.2+dfsg-2ubuntu6.281:6.2+dfsg-2ubuntu6.291:6.2+dfsg-2ubuntu6.301:6.2+dfsg-2ubuntu6.31 |
None known |
qemuUbuntu:24.04:LTS |
All versions, plus listed versions 1:8.0.4+dfsg-1ubuntu31:8.0.4+dfsg-1ubuntu41:8.0.4+dfsg-1ubuntu51:8.1.3+ds-1ubuntu21:8.2.1+ds-1ubuntu1 Show 19 moreShow less1:8.2.1+ds-1ubuntu81:8.2.1+ds-1ubuntu91:8.2.2+ds-0ubuntu11:8.2.2+ds-0ubuntu1.21:8.2.2+ds-0ubuntu1.41:8.2.2+ds-0ubuntu1.51:8.2.2+ds-0ubuntu1.61:8.2.2+ds-0ubuntu1.71:8.2.2+ds-0ubuntu1.81:8.2.2+ds-0ubuntu1.91:8.2.2+ds-0ubuntu1.101:8.2.2+ds-0ubuntu1.111:8.2.2+ds-0ubuntu1.121:8.2.2+ds-0ubuntu1.131:8.2.2+ds-0ubuntu1.141:8.2.2+ds-0ubuntu1.151:8.2.2+ds-0ubuntu1.161:8.2.2+ds-0ubuntu1.171:8.2.2+ds-0ubuntu1.18 |
None known |
qemuUbuntu:25.10 |
All versions, plus listed versions 1:9.2.1+ds-1ubuntu51:10.0.2+ds-1ubuntu11:10.0.2+ds-1ubuntu21:10.1.0+ds-1ubuntu11:10.1.0+ds-5ubuntu1 Show 7 moreShow less1:10.1.0+ds-5ubuntu21:10.1.0+ds-5ubuntu2.11:10.1.0+ds-5ubuntu2.21:10.1.0+ds-5ubuntu2.41:10.1.0+ds-5ubuntu2.51:10.1.0+ds-5ubuntu2.61:10.1.0+ds-5ubuntu2.7 |
None known |
qemuUbuntu:26.10 |
All versions, plus listed versions 1:10.2.1+ds-1ubuntu31:10.2.1+ds-1ubuntu61:11.0.3+ds-2ubuntu11:11.0.3+ds-2ubuntu2 |
None known |
qemu-hweUbuntu:26.10 |
All versions, plus listed versions 1:10.2.1+ds-1ubuntu41:10.2.1+ds-1ubuntu71:10.2.1+ds-1ubuntu81:11.0.3+ds-2ubuntu21:11.0.3+ds-2ubuntu4 |
None known |
qemuUbuntu:26.04:LTS |
All versions, plus listed versions 1:10.1.0+ds-5ubuntu21:10.1.0+ds-5ubuntu31:10.1.0+ds-5ubuntu41:10.1.0+ds-5ubuntu51:10.2.1+ds-1ubuntu1 Show 5 moreShow less1:10.2.1+ds-1ubuntu21:10.2.1+ds-1ubuntu31:10.2.1+ds-1ubuntu3.11:10.2.1+ds-1ubuntu3.21:10.2.1+ds-1ubuntu3.3 |
None known |
qemu-hweUbuntu:26.04:LTS |
All versions, plus listed versions 1:10.2.1+ds-1ubuntu21:10.2.1+ds-1ubuntu41:10.2.1+ds-1ubuntu4.21:10.2.1+ds-1ubuntu4.31:10.2.1+ds-1ubuntu4.4 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-13791 is a medium vulnerability (CVSS 5.5) in Qemu, published June 4, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. Fixed in qemu 5.0.0-r0.
References
lists.gnu.org/archive/html/qemu-devel/2020-06/msg00706.html
openwall.com/lists/oss-security/2020/06/04/1
security.netapp.com/advisory/ntap-20200717-0001
security.gentoo.org/glsa/202011-09
nvd.nist.gov/vuln/detail/CVE-2020-13791
github.com/advisories/GHSA-9j9x-v7hw-3v8f
Show 9 moreShow less
security.alpinelinux.org/vuln/CVE-2020-13791
docs.bell-sw.com/security/cves/CVE-2020-13791
security-tracker.debian.org/tracker/CVE-2020-13791
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1654
ubuntu.com/security/CVE-2020-13791
cve.org/CVERecord?id=CVE-2020-13791