{"id":"CVE-2023-0664","aliases":["EUVD-2023-12697","GHSA-mvgg-p48p-h9jc","OESA-2023-1472","OESA-2023-1473","OESA-2023-1474","OESA-2023-1475","OESA-2023-1476","RHBA-2023:2451"],"status":"published","title":"A flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be...","description":"A flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be able to manipulate the QEMU Guest Agent's Windows installer via repair custom actions to elevate their privileges on the system.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00306,"percentile":0.23534,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-250","CWE-269"],"published":"2023-03-29T00:00:00Z","modified":"2026-10-28T10:31:40Z","fixes":[{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"virtio-win","fixed_in":["0:1.9.33-0.el9_2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.0-74.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.0-78.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-72.oe2203"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-76.oe2203sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-76.oe2203sp2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"virtio-win","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.33-0.el9_2"}]}]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"qemu","product":"qemu"},{"vendor":"redhat","product":"enterprise_linux"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2167423","tags":["x_transferred","Issue Tracking","Patch","Third Party Advisory","report"]},{"url":"https://lists.nongnu.org/archive/html/qemu-devel/2023-03/msg01445.html","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://gitlab.com/qemu-project/qemu/-/commit/88288c2a51faa7c795f053fc8b31b1c16ff804c5","tags":["x_transferred","Patch","fix"]},{"url":"https://gitlab.com/qemu-project/qemu/-/commit/07ce178a2b0768eb9e712bb5ad0cf6dc7fcf0158","tags":["x_transferred","Patch","fix"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SEOC7SRJWLZSXCND2ADFW6C76ZMTZLE4/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20230517-0005/","tags":["x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MURWGXDIF2WTDXV36T6HFJDBL632AO7R/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0664","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MURWGXDIF2WTDXV36T6HFJDBL632AO7R"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SEOC7SRJWLZSXCND2ADFW6C76ZMTZLE4"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MURWGXDIF2WTDXV36T6HFJDBL632AO7R"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SEOC7SRJWLZSXCND2ADFW6C76ZMTZLE4"},{"url":"https://security.netapp.com/advisory/ntap-20230517-0005"},{"url":"https://github.com/advisories/GHSA-mvgg-p48p-h9jc"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/0xxx/CVE-2023-0664.json","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1472","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-2861","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1473","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1474","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1050","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1475","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1476","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHBA-2023:2451","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.2_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1983947","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1999409","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2019712","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020998","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2023639","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2026299","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2042247","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2072090","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2112559","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2119336","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2120249","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2123350","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2138303","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2139663","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2149547","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2153741","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhba-2023_2451.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-0664","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-0664","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-0664","description":"A flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be able to manipulate the QEMU Guest Agent's Windows installer via repair custom actions to elevate their privileges on the system.","status":"published","published":"2023-03-29T00:00:00Z","modified":"2025-02-18T19:15:55.07Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-250","CWE-269"],"updated_at":"2026-11-02T14:35:35.256261Z"}],"euvd":[{"id":"EUVD-2023-12697","description":"A flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be able to manipulate the QEMU Guest Agent's Windows installer via repair custom actions to elevate their privileges on the system.","status":"published","published":"2023-03-29T00:00:00Z","modified":"2025-02-18T19:15:55Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:53:28.492188Z"}],"ghsa":[{"id":"GHSA-mvgg-p48p-h9jc","title":"A flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be...","description":"A flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be able to manipulate the QEMU Guest Agent's Windows installer via repair custom actions to elevate their privileges on the system.","status":"published","published":"2023-03-29T21:30:16Z","modified":"2025-02-18T21:33:12Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-250","CWE-269"],"updated_at":"2026-11-02T14:59:58.679357Z"}],"nvd":[{"id":"CVE-2023-0664","description":"A flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be able to manipulate the QEMU Guest Agent's Windows installer via repair custom actions to elevate their privileges on the system.","status":"published","published":"2023-03-29T20:15:07.347Z","modified":"2026-06-17T05:26:02.55Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-250","CWE-269"],"updated_at":"2026-11-02T14:07:51.883939Z"}],"osv":[{"id":"CVE-2023-0664","description":"A flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be able to manipulate the QEMU Guest Agent's Windows installer via repair custom actions to elevate their privileges on the system.","status":"published","published":"2023-03-29T00:00:00Z","modified":"2026-10-28T10:31:40.102495811Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-250"],"updated_at":"2026-11-02T15:44:29.487253Z"},{"id":"OESA-2023-1472","title":"qemu security update","description":"QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be able to manipulate the QEMU Guest Agent\u0026apos;s Windows installer via repair custom actions to elevate their privileges on the system.(CVE-2023-0664)\r\n\r\nA flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. The 9pfs server did not prohibit opening special files on the host side, potentially allowing a malicious client to escape from the exported 9p tree by creating and opening a device file in the shared folder.(CVE-2023-2861)","status":"published","published":"2023-08-06T11:05:56Z","modified":"2026-08-18T01:17:46.486638886Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"OESA-2023-1473","title":"qemu security update","description":"QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be able to manipulate the QEMU Guest Agent\u0026apos;s Windows installer via repair custom actions to elevate their privileges on the system.(CVE-2023-0664)\r\n\r\nA flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. The 9pfs server did not prohibit opening special files on the host side, potentially allowing a malicious client to escape from the exported 9p tree by creating and opening a device file in the shared folder.(CVE-2023-2861)","status":"published","published":"2023-08-06T11:05:56Z","modified":"2026-08-18T01:17:46.287260268Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"OESA-2023-1474","title":"qemu security update","description":"QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in the QEMU implementation of VMWare\u0026apos;s paravirtual RDMA device. This flaw allows a crafted guest driver to execute HW commands when shared buffers are not yet allocated, potentially leading to a use-after-free condition.(CVE-2022-1050)\r\n\r\nA flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be able to manipulate the QEMU Guest Agent\u0026apos;s Windows installer via repair custom actions to elevate their privileges on the system.(CVE-2023-0664)\r\n\r\nA flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. The 9pfs server did not prohibit opening special files on the host side, potentially allowing a malicious client to escape from the exported 9p tree by creating and opening a device file in the shared folder.(CVE-2023-2861)","status":"published","published":"2023-08-06T11:05:56Z","modified":"2026-08-18T01:17:45.973061485Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"OESA-2023-1475","title":"qemu security update","description":"QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be able to manipulate the QEMU Guest Agent\u0026apos;s Windows installer via repair custom actions to elevate their privileges on the system.(CVE-2023-0664)\r\n\r\nA flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. The 9pfs server did not prohibit opening special files on the host side, potentially allowing a malicious client to escape from the exported 9p tree by creating and opening a device file in the shared folder.(CVE-2023-2861)","status":"published","published":"2023-08-06T11:05:56Z","modified":"2026-08-18T01:17:46.641051265Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"OESA-2023-1476","title":"qemu security update","description":"QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be able to manipulate the QEMU Guest Agent\u0026apos;s Windows installer via repair custom actions to elevate their privileges on the system.(CVE-2023-0664)\r\n\r\nA flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. The 9pfs server did not prohibit opening special files on the host side, potentially allowing a malicious client to escape from the exported 9p tree by creating and opening a device file in the shared folder.(CVE-2023-2861)","status":"published","published":"2023-08-06T11:05:56Z","modified":"2026-08-18T01:17:46.493224805Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"RHBA-2023:2451","title":"Red Hat Bug Fix Advisory: virtio-win bug fix and enhancement update","status":"published","published":"2024-09-16T10:50:43Z","modified":"2026-06-27T10:16:22Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"}]}}