{"id":"CVE-2025-14876","aliases":["AZL-78174","BELL-CVE-2025-14876","DEBIAN-CVE-2025-14876","EUVD-2025-207825","GHSA-gq25-pccv-6q8j","OESA-2026-1988","OESA-2026-1989","OESA-2026-1990","OESA-2026-1991","OESA-2026-1992","SUSE-SU-2026:0662-1","SUSE-SU-2026:0832-1","SUSE-SU-2026:0889-1","SUSE-SU-2026:20666-1","SUSE-SU-2026:20693-1","SUSE-SU-2026:20716-1","SUSE-SU-2026:21883-1","SUSE-SU-2026:21912-1","SUSE-SU-2026:2386-1","UBUNTU-CVE-2025-14876","USN-8073-1","openSUSE-SU-2026:10265-1","openSUSE-SU-2026:20357-1"],"status":"published","title":"Qemu-kvm: unbounded allocation in virtio-crypto","description":"A flaw was found in the virtio-crypto device of QEMU. A malicious guest operating system can exploit a missing length limit in the AKCIPHER path, leading to uncontrolled memory allocation. This can result in a denial of service (DoS) on the host system by causing the QEMU process to terminate unexpectedly.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00155,"percentile":0.04738,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2025-12-19T06:06:16.48852Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:3","package":"qemu","fixed_in":["9.1.0-3"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"qemu","fixed_in":["10.0.9-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"qemu","fixed_in":["11.0.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"qemu","fixed_in":["1:10.0.8+ds-0+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"qemu","fixed_in":["1:10.2.1+ds-1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"qemu","fixed_in":["8.2.0-73.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"qemu","fixed_in":["6.2.0-113.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"qemu","fixed_in":["8.2.0-55.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"qemu","fixed_in":["8.2.0-55.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"qemu","fixed_in":["8.2.0-56.oe2403sp2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"qemu","fixed_in":["9.2.4-150700.3.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"qemu","fixed_in":["9.2.4-150700.3.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"qemu-linux-user","fixed_in":["9.2.4-150700.3.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"qemu","fixed_in":["9.2.4-150700.3.17.1","7.1.0-150500.49.39.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"qemu","fixed_in":["7.1.0-150500.49.39.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"qemu","fixed_in":["1:8.2.2+ds-0ubuntu1.13"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"qemu","fixed_in":["1:10.1.0+ds-5ubuntu2.4"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"qemu","fixed_in":["10.2.1-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.0-3"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.1.0-r4"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-r1"},{"fixed":"10.0.9-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.2-r0"},{"fixed":"11.0.0-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.0.0+ds-1","1:10.0.0+ds-2","1:10.0.0+ds-2~bpo12+1","1:10.0.0+ds-2~bpo12+2","1:10.0.0~rc0+ds-1","1:10.0.0~rc0+ds-2","1:10.0.0~rc1+ds-1","1:10.0.0~rc1+ds-2","1:10.0.0~rc2+ds-1","1:10.0.0~rc2+ds-2","1:10.0.0~rc3+ds-1","1:10.0.0~rc3+ds-2","1:10.0.2+ds-1","1:10.0.2+ds-2","1:10.0.2+ds-2~bpo12+1","1:10.0.3+ds-1","1:10.0.3+ds-2","1:10.0.3+ds-3","1:10.0.3+ds-4","1:10.1.0+ds-1","1:10.1.0+ds-2","1:10.1.0+ds-3","1:10.1.0+ds-4","1:10.1.0+ds-5","1:10.1.0~rc0+ds-1","1:10.1.0~rc0+ds-2","1:10.1.0~rc0+ds-3","1:10.1.0~rc0+ds-4","1:10.1.0~rc1+ds-1","1:10.1.0~rc1+ds-1a","1:10.1.0~rc1+ds-1b","1:10.1.0~rc1+ds-2","1:10.1.0~rc1+ds-3","1:10.1.0~rc2+ds-1","1:10.1.0~rc3+ds-1","1:10.1.0~rc3+ds-2","1:10.1.1+ds-1","1:10.1.2+ds-1","1:10.1.2+ds-2","1:10.1.2+ds-3","1:10.1.3+ds-1","1:10.2.0+ds-1","1:10.2.0+ds-2","1:10.2.0~rc1+ds-1","1:10.2.1+ds-1","1:10.2.2+ds-1","1:11.0.0+ds-1","1:11.0.0+ds-2","1:11.0.0~rc0+ds-1","1:11.0.0~rc0+ds-2","1:11.0.0~rc1+ds-1","1:11.0.0~rc1+ds-2","1:11.0.0~rc1+ds-3","1:11.0.0~rc2+ds-1","1:11.0.0~rc2+ds-2","1:11.0.0~rc3+ds-1","1:11.0.1+ds-1","1:11.0.2+ds-1","1:11.0.2+ds-2","1:11.0.2+ds-2~bpo13+1","1:11.0.3+ds-1","1:11.0.3+ds-2","1:11.1.0+ds-1","1:11.1.0+ds-2","1:11.1.0~rc0+ds-1","1:11.1.0~rc0+ds-2","1:11.1.0~rc1+ds-1","1:11.1.0~rc3+ds-1","1:11.1.0~rc3+ds-2","1:11.1.1+ds-1","1:7.2+dfsg-7","1:7.2+dfsg-7+deb12u1","1:7.2+dfsg-7+deb12u10","1:7.2+dfsg-7+deb12u11","1:7.2+dfsg-7+deb12u12","1:7.2+dfsg-7+deb12u13","1:7.2+dfsg-7+deb12u14","1:7.2+dfsg-7+deb12u15","1:7.2+dfsg-7+deb12u16","1:7.2+dfsg-7+deb12u17","1:7.2+dfsg-7+deb12u18","1:7.2+dfsg-7+deb12u2","1:7.2+dfsg-7+deb12u2~bpo11+1","1:7.2+dfsg-7+deb12u3","1:7.2+dfsg-7+deb12u4","1:7.2+dfsg-7+deb12u5","1:7.2+dfsg-7+deb12u6","1:7.2+dfsg-7+deb12u7","1:7.2+dfsg-7+deb12u8","1:7.2+dfsg-7+deb12u9","1:8.0+dfsg-1","1:8.0+dfsg-2","1:8.0+dfsg-3","1:8.0+dfsg-4","1:8.0.2+dfsg-1","1:8.0.2+dfsg-2","1:8.0.2+dfsg-3","1:8.0.3+dfsg-1","1:8.0.3+dfsg-1~bpo12+1","1:8.0.3+dfsg-2","1:8.0.3+dfsg-3","1:8.0.3+dfsg-4","1:8.0.3+dfsg-5","1:8.0.4+dfsg-1","1:8.0.4+dfsg-1~bpo12+1","1:8.0.4+dfsg-2","1:8.0.4+dfsg-3","1:8.0~rc2+dfsg-1","1:8.0~rc3+dfsg-1","1:8.0~rc3+dfsg-2","1:8.0~rc4+dfsg-1","1:8.0~rc4+dfsg-2","1:8.1.0+ds-1","1:8.1.0+ds-1~exp1","1:8.1.0+ds-1~exp2","1:8.1.0+ds-2","1:8.1.0+ds-3","1:8.1.0+ds-4","1:8.1.0+ds-5","1:8.1.0+ds-6","1:8.1.0~rc2+dfsg-1","1:8.1.0~rc3+dfsg-1","1:8.1.0~rc3+dfsg-2","1:8.1.0~rc4+ds-1","1:8.1.0~rc4+ds-2","1:8.1.0~rc4+ds-3","1:8.1.0~rc4+ds-4","1:8.1.1+ds-1","1:8.1.1+ds-2","1:8.1.1+ds-2~bpo12+1","1:8.1.2+ds-1","1:8.1.2+ds-1~bpo12+1","1:8.1.3+ds-1","1:8.2.0+ds-1","1:8.2.0+ds-2","1:8.2.0+ds-3","1:8.2.0+ds-4","1:8.2.0+ds-5","1:8.2.0+ds-5~bpo12+1","1:8.2.0~rc0+ds-1","1:8.2.0~rc1+ds-1","1:8.2.0~rc2+ds-1","1:8.2.1+ds-1","1:8.2.1+ds-1~bpo12+1","1:8.2.1+ds-2","1:8.2.2+ds-1","1:8.2.2+ds-2","1:8.2.3+ds-1","1:8.2.3+ds-2","1:8.2.4+ds-1","1:8.2.4+ds-2","1:8.2.5+ds-1","1:8.2.5+ds-2","1:9.0.0~rc0+ds-1","1:9.0.0~rc0+ds-2","1:9.0.0~rc2+ds-1","1:9.0.1+ds-1","1:9.0.1+ds-1~bpo12+1","1:9.0.2+ds-1","1:9.0.2+ds-1~bpo12+1","1:9.0.2+ds-2","1:9.0.2+ds-3","1:9.0.2+ds-4","1:9.0.2+ds-5","1:9.0.2+ds-6","1:9.0.2+ds-7","1:9.1.0+ds-1","1:9.1.0+ds-2","1:9.1.0+ds-3","1:9.1.0+ds-4","1:9.1.0+ds-5","1:9.1.0+ds-6","1:9.1.0+ds-7","1:9.1.0+ds-8","1:9.1.0+ds-9~exp0","1:9.1.0~rc0+ds-1","1:9.1.0~rc0+ds-2","1:9.1.0~rc0+ds-3","1:9.1.1+ds-1","1:9.1.1+ds-2","1:9.1.1+ds-2~bpo12+1","1:9.1.1+ds-3","1:9.1.1+ds-4","1:9.1.1+ds-5","1:9.1.2+ds-1","1:9.1.2+ds-1~bpo12+1","1:9.2.0+ds-1","1:9.2.0+ds-1~exp1","1:9.2.0+ds-2","1:9.2.0+ds-3","1:9.2.0+ds-3~bpo12+1","1:9.2.0+ds-3~bpo12+2","1:9.2.0+ds-4","1:9.2.0+ds-5","1:9.2.0~rc0+ds-1","1:9.2.0~rc3+ds-1","1:9.2.1+ds-1","1:9.2.2+ds-1","1:9.2.2+ds-1~bpo12+1"]},{"source":"osv","ecosystem":"Debian:13","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.0.8+ds-0+deb13u1"}]}],"versions":["1:10.0.2+ds-2","1:10.0.2+ds-2+deb13u1","1:10.0.2+ds-2+deb13u1~bpo12+1","1:10.0.3+ds-0+deb13u1","1:10.0.3+ds-1","1:10.0.3+ds-2","1:10.0.3+ds-3","1:10.0.3+ds-4","1:10.0.6+ds-0+deb13u1","1:10.0.6+ds-0+deb13u2","1:10.0.7+ds-0+deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.2.1+ds-1"}]}],"versions":["1:10.0.2+ds-2","1:10.0.3+ds-1","1:10.0.3+ds-2","1:10.0.3+ds-3","1:10.0.3+ds-4","1:10.1.0+ds-1","1:10.1.0+ds-2","1:10.1.0+ds-3","1:10.1.0+ds-4","1:10.1.0+ds-5","1:10.1.0~rc0+ds-1","1:10.1.0~rc0+ds-2","1:10.1.0~rc0+ds-3","1:10.1.0~rc0+ds-4","1:10.1.0~rc1+ds-1","1:10.1.0~rc1+ds-1a","1:10.1.0~rc1+ds-1b","1:10.1.0~rc1+ds-2","1:10.1.0~rc1+ds-3","1:10.1.0~rc2+ds-1","1:10.1.0~rc3+ds-1","1:10.1.0~rc3+ds-2","1:10.1.1+ds-1","1:10.1.2+ds-1","1:10.1.2+ds-2","1:10.1.2+ds-3","1:10.1.3+ds-1","1:10.2.0+ds-1","1:10.2.0+ds-2","1:10.2.0~rc1+ds-1"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.0-73.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-113.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.0-55.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.0-55.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.0-56.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.10-150600.3.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"qemu-linux-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.10-150600.3.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.4-150700.3.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.4-150700.3.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"qemu-linux-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.4-150700.3.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.4-150700.3.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-150500.49.39.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-150500.49.39.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.10-slfo.1.1_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.8-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.10-2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.10-150600.3.49.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.10-150600.3.49.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.2.2+ds-0ubuntu1.13"}]}],"versions":["1:8.0.4+dfsg-1ubuntu3","1:8.0.4+dfsg-1ubuntu4","1:8.0.4+dfsg-1ubuntu5","1:8.1.3+ds-1ubuntu2","1:8.2.1+ds-1ubuntu1","1:8.2.1+ds-1ubuntu8","1:8.2.1+ds-1ubuntu9","1:8.2.2+ds-0ubuntu1","1:8.2.2+ds-0ubuntu1.2","1:8.2.2+ds-0ubuntu1.4","1:8.2.2+ds-0ubuntu1.5","1:8.2.2+ds-0ubuntu1.6","1:8.2.2+ds-0ubuntu1.7","1:8.2.2+ds-0ubuntu1.8","1:8.2.2+ds-0ubuntu1.9","1:8.2.2+ds-0ubuntu1.10","1:8.2.2+ds-0ubuntu1.11","1:8.2.2+ds-0ubuntu1.12"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.0+ds-5ubuntu2.4"}]}],"versions":["1:9.2.1+ds-1ubuntu5","1:10.0.2+ds-1ubuntu1","1:10.0.2+ds-1ubuntu2","1:10.1.0+ds-1ubuntu1","1:10.1.0+ds-5ubuntu1","1:10.1.0+ds-5ubuntu2","1:10.1.0+ds-5ubuntu2.1","1:10.1.0+ds-5ubuntu2.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.2+dfsg-2ubuntu6.28"}]}],"versions":["1:6.0+dfsg-2expubuntu1","1:6.0+dfsg-2expubuntu2","1:6.0+dfsg-2expubuntu4","1:6.2+dfsg-2ubuntu5","1:6.2+dfsg-2ubuntu6","1:6.2+dfsg-2ubuntu6.1","1:6.2+dfsg-2ubuntu6.2","1:6.2+dfsg-2ubuntu6.3","1:6.2+dfsg-2ubuntu6.4","1:6.2+dfsg-2ubuntu6.5","1:6.2+dfsg-2ubuntu6.6","1:6.2+dfsg-2ubuntu6.7","1:6.2+dfsg-2ubuntu6.8","1:6.2+dfsg-2ubuntu6.9","1:6.2+dfsg-2ubuntu6.10","1:6.2+dfsg-2ubuntu6.11","1:6.2+dfsg-2ubuntu6.12","1:6.2+dfsg-2ubuntu6.13","1:6.2+dfsg-2ubuntu6.14","1:6.2+dfsg-2ubuntu6.15","1:6.2+dfsg-2ubuntu6.16","1:6.2+dfsg-2ubuntu6.17","1:6.2+dfsg-2ubuntu6.18","1:6.2+dfsg-2ubuntu6.19","1:6.2+dfsg-2ubuntu6.21","1:6.2+dfsg-2ubuntu6.22","1:6.2+dfsg-2ubuntu6.23","1:6.2+dfsg-2ubuntu6.24","1:6.2+dfsg-2ubuntu6.25","1:6.2+dfsg-2ubuntu6.26","1:6.2+dfsg-2ubuntu6.27"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.2.2+ds-0ubuntu1.13"}]}],"versions":["1:8.0.4+dfsg-1ubuntu3","1:8.0.4+dfsg-1ubuntu4","1:8.0.4+dfsg-1ubuntu5","1:8.1.3+ds-1ubuntu2","1:8.2.1+ds-1ubuntu1","1:8.2.1+ds-1ubuntu8","1:8.2.1+ds-1ubuntu9","1:8.2.2+ds-0ubuntu1","1:8.2.2+ds-0ubuntu1.2","1:8.2.2+ds-0ubuntu1.4","1:8.2.2+ds-0ubuntu1.5","1:8.2.2+ds-0ubuntu1.6","1:8.2.2+ds-0ubuntu1.7","1:8.2.2+ds-0ubuntu1.8","1:8.2.2+ds-0ubuntu1.9","1:8.2.2+ds-0ubuntu1.10","1:8.2.2+ds-0ubuntu1.11","1:8.2.2+ds-0ubuntu1.12"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.0+ds-5ubuntu2.4"}]}],"versions":["1:9.2.1+ds-1ubuntu5","1:10.0.2+ds-1ubuntu1","1:10.0.2+ds-1ubuntu2","1:10.1.0+ds-1ubuntu1","1:10.1.0+ds-5ubuntu1","1:10.1.0+ds-5ubuntu2","1:10.1.0+ds-5ubuntu2.1","1:10.1.0+ds-5ubuntu2.2"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.1-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.8-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"qemu-linux-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.8-160000.1.1"}]}],"bundled":2}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat openshift container platform 4"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2025-14876","tags":["vdb-entry","x_refsource_REDHAT","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2423549","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14876","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-gq25-pccv-6q8j"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-14876","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/14xxx/CVE-2025-14876.json","tags":["advisory"]},{"url":"https://gitlab.com/qemu-project/qemu","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-14876","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1988","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1989","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1990","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1991","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1992","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260662-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1255400","tags":["report"]},{"url":"https://bugzilla.suse.com/1256484","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-14876","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-0665","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260832-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260889-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620666-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620693-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1257474","tags":["report"]},{"url":"https://bugzilla.suse.com/1257492","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620716-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621883-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1258509","tags":["report"]},{"url":"https://bugzilla.suse.com/1259079","tags":["report"]},{"url":"https://bugzilla.suse.com/1259080","tags":["report"]},{"url":"https://bugzilla.suse.com/1262089","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2243","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3196","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3842","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621912-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262386-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1199023","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-14876","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-14876","tags":["report"]},{"url":"https://lore.kernel.org/qemu-devel/20251214090939.408436-1-zhenwei.pi@linux.dev/T/#u","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8073-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-8354","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-11234","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-12464","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-0665","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-14876","title":"Qemu-kvm: unbounded allocation in virtio-crypto","description":"A flaw was found in the virtio-crypto device of QEMU. A malicious guest operating system can exploit a missing length limit in the AKCIPHER path, leading to uncontrolled memory allocation. This can result in a denial of service (DoS) on the host system by causing the QEMU process to terminate unexpectedly.","status":"published","published":"2026-02-18T20:47:54.302Z","modified":"2026-02-19T14:33:52.744Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:32:28.621398Z"}],"euvd":[{"id":"EUVD-2025-207825","description":"A flaw was found in the virtio-crypto device of QEMU. A malicious guest operating system can exploit a missing length limit in the AKCIPHER path, leading to uncontrolled memory allocation. This can result in a denial of service (DoS) on the host system by causing the QEMU process to terminate unexpectedly.","status":"published","published":"2026-02-18T20:47:54Z","modified":"2026-02-19T14:33:52Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T19:48:37.43406Z"}],"ghsa":[{"id":"GHSA-gq25-pccv-6q8j","title":"A flaw was found in the virtio-crypto device of QEMU. A malicious guest operating system can...","description":"A flaw was found in the virtio-crypto device of QEMU. A malicious guest operating system can exploit a missing length limit in the AKCIPHER path, leading to uncontrolled memory allocation. This can result in a denial of service (DoS) on the host system by causing the QEMU process to terminate unexpectedly.","status":"published","published":"2026-02-18T21:31:23Z","modified":"2026-02-18T21:31:35Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:06:15.594622Z"}],"nvd":[{"id":"CVE-2025-14876","description":"A flaw was found in the virtio-crypto device of QEMU. A malicious guest operating system can exploit a missing length limit in the AKCIPHER path, leading to uncontrolled memory allocation. This can result in a denial of service (DoS) on the host system by causing the QEMU process to terminate unexpectedly.","status":"published","published":"2026-02-18T21:16:20.947Z","modified":"2026-06-17T08:36:41.66Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:12:00.273026Z"}],"osv":[{"id":"BELL-CVE-2025-14876","status":"published","published":"2025-12-19T06:06:16.48852Z","modified":"2026-08-14T07:15:04.765657429Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:21.227396Z"},{"id":"CVE-2025-14876","title":"Qemu-kvm: unbounded allocation in virtio-crypto","description":"A flaw was found in the virtio-crypto device of QEMU. A malicious guest operating system can exploit a missing length limit in the AKCIPHER path, leading to uncontrolled memory allocation. This can result in a denial of service (DoS) on the host system by causing the QEMU process to terminate unexpectedly.","status":"published","published":"2026-02-18T20:47:54.302Z","modified":"2026-10-28T02:31:05.924384724Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:44:46.340268Z"},{"id":"DEBIAN-CVE-2025-14876","description":"A flaw was found in the virtio-crypto device of QEMU. A malicious guest operating system can exploit a missing length limit in the AKCIPHER path, leading to uncontrolled memory allocation. This can result in a denial of service (DoS) on the host system by causing the QEMU process to terminate unexpectedly.","status":"published","published":"2026-02-18T21:16:20.947Z","modified":"2026-09-01T20:05:41.334718921Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:45.102284Z"},{"id":"OESA-2026-1988","title":"qemu security update","description":"QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in the virtio-crypto device of QEMU. A malicious guest operating system can exploit a missing length limit in the AKCIPHER path, leading to uncontrolled memory allocation. This can result in a denial of service (DoS) on the host system by causing the QEMU process to terminate unexpectedly.(CVE-2025-14876)","status":"published","published":"2026-04-17T11:10:59Z","modified":"2026-08-18T01:19:39.26742382Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-1989","title":"qemu security update","description":"QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in the virtio-crypto device of QEMU. A malicious guest operating system can exploit a missing length limit in the AKCIPHER path, leading to uncontrolled memory allocation. This can result in a denial of service (DoS) on the host system by causing the QEMU process to terminate unexpectedly.(CVE-2025-14876)","status":"published","published":"2026-04-17T11:10:59Z","modified":"2026-08-18T01:19:44.383290233Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-1990","title":"qemu security update","description":"QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in the virtio-crypto device of QEMU. A malicious guest operating system can exploit a missing length limit in the AKCIPHER path, leading to uncontrolled memory allocation. This can result in a denial of service (DoS) on the host system by causing the QEMU process to terminate unexpectedly.(CVE-2025-14876)","status":"published","published":"2026-04-17T11:10:59Z","modified":"2026-08-18T01:19:44.469578505Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-1991","title":"qemu security update","description":"QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in the virtio-crypto device of QEMU. A malicious guest operating system can exploit a missing length limit in the AKCIPHER path, leading to uncontrolled memory allocation. This can result in a denial of service (DoS) on the host system by causing the QEMU process to terminate unexpectedly.(CVE-2025-14876)","status":"published","published":"2026-04-17T11:10:59Z","modified":"2026-08-18T01:19:44.410814247Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-1992","title":"qemu security update","description":"QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in the virtio-crypto device of QEMU. A malicious guest operating system can exploit a missing length limit in the AKCIPHER path, leading to uncontrolled memory allocation. This can result in a denial of service (DoS) on the host system by causing the QEMU process to terminate unexpectedly.(CVE-2025-14876)","status":"published","published":"2026-04-17T11:10:59Z","modified":"2026-08-18T01:19:44.442814651Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"UBUNTU-CVE-2025-14876","description":"A flaw was found in the virtio-crypto device of QEMU. A malicious guest operating system can exploit a missing length limit in the AKCIPHER path, leading to uncontrolled memory allocation. This can result in a denial of service (DoS) on the host system by causing the QEMU process to terminate unexpectedly.","status":"published","published":"2026-02-18T21:16:00Z","modified":"2026-03-05T18:44:48.286111Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:55:20.144818Z"},{"id":"AZL-78174","title":"CVE-2025-14876 affecting package qemu for versions less than 9.1.0-3","description":"A flaw was found in the virtio-crypto device of QEMU. A malicious guest operating system can exploit a missing length limit in the AKCIPHER path, leading to uncontrolled memory allocation. This can result in a denial of service (DoS) on the host system by causing the QEMU process to terminate unexpectedly.","status":"published","published":"2026-02-18T21:16:20Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.626116Z"},{"id":"openSUSE-SU-2026:10265-1","title":"qemu-10.2.1-1.1 on GA media","description":"These are all security issues fixed in the qemu-10.2.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-02-26T00:00:00Z","modified":"2026-03-23T04:54:37.832558Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:20357-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- Update to version 10.0.8\n- CVE-2025-14876: Fixed unbounded allocation in virtio-crypto. (bsc#1255400)\n- CVE-2026-0665: Fixed PIRQ bounds check in xen_physdev_map_pirq. (bsc#1256484)\n","status":"published","published":"2026-03-13T10:47:15Z","modified":"2026-03-23T04:54:51.307873Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:0662-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- CVE-2025-14876: qemu-kvm: Unbounded allocation in virtio-crypto (bsc#1255400).\n- CVE-2026-0665: out-of-bounds heap access can lead to a denial of service or potential memory corruption (bsc#1256484).\n","status":"published","published":"2026-02-26T15:12:26Z","modified":"2026-03-23T04:52:24.176442Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0832-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\nSecurity issue:\n\n- CVE-2025-14876: qemu-kvm: Unbounded allocation in virtio-crypto (bsc#1255400).\n\nNon security issues:\n\n- * hw/virtio: Also include md stubs in case CONFIG_VIRTIO_PCI is not set (jsc#PED-14271).\n- * s390x/pv: prepare for memory devices (jsc#PED-14271).\n- * s390x/s390-skeys: prepare for memory devices (jsc#PED-14271).\n- * s390x/s390-stattrib-kvm: prepare for memory devices and sparse memory layouts (jsc#PED-14271).\n- * s390x/s390-virtio-ccw: prepare for memory devices (jsc#PED-14271).\n- * s390x/virtio-ccw: add support for virtio based memory devices (jsc#PED-14271).\n- * s390x: remember the maximum page size (jsc#PED-14271).\n- * s390x: virtio-mem support (jsc#PED-14271).\n","status":"published","published":"2026-03-05T16:38:47Z","modified":"2026-03-06T15:30:06.537835Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:0889-1","title":"Security update for qemu","description":"This update for qemu fixes the following issue:\n\n- CVE-2025-14876: qemu-kvm: Unbounded allocation in virtio-crypto (bsc#1255400).\n","status":"published","published":"2026-03-13T07:58:55Z","modified":"2026-03-14T08:15:58.693279Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:20666-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- CVE-2025-14876: Fixed unbounded allocation in virtio-crypto. (bsc#1255400)\n- CVE-2026-0665: Fixed PIRQ bounds check in xen_physdev_map_pirq. (bsc#1256484)\n","status":"published","published":"2026-03-11T11:28:39Z","modified":"2026-03-23T04:53:06.964966Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:20693-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- Update to version 10.0.8\n- CVE-2025-14876: Fixed unbounded allocation in virtio-crypto. (bsc#1255400)\n- CVE-2026-0665: Fixed PIRQ bounds check in xen_physdev_map_pirq. (bsc#1256484)\n","status":"published","published":"2026-03-13T10:41:36Z","modified":"2026-03-23T04:53:08.593858Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:20716-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- CVE-2025-14876: Fixed unbounded allocation in virtio-crypto. (bsc#1255400)\n- CVE-2026-0665: Fixed PIRQ bounds check in xen_physdev_map_pirq. (bsc#1256484)\n","status":"published","published":"2026-03-10T18:34:11Z","modified":"2026-03-23T04:53:09.136598Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:21883-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues\n\n- CVE-2025-14876: qemu-kvm: Unbounded allocation in virtio-crypto (bsc#1255400).\n- CVE-2026-0665: out-of-bounds heap access can lead to a denial of service or potential memory corruption (bsc#1256484).\n- CVE-2026-2243: incorrect bounds check leads to heap out-of-bounds read and a 12-byte information leak when processing\n  specially crafted VMDK files (bsc#1258509).\n- CVE-2026-3195: heap buffer overflow when reading input audio in the virtio-snd device input callback due to\n  insufficient checks in `virtio_snd_pcm_in_cb` (bsc#1259080).\n- CVE-2026-3196: integer overflow in the virtio-snd device via PCM_INFO requests from the guest leads to unbounded\n  memory allocation and host denial-of-service (bsc#1259079).\n- CVE-2026-3842: hyperv/syndbg: missing mapped-length guard after cpu_physical_memory_map causes host OOB write\n  (bsc#1262089).\n","status":"published","published":"2026-06-01T13:45:56Z","modified":"2026-06-03T18:24:40.689343957Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:21912-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues\n\n- CVE-2025-14876: qemu-kvm: Unbounded allocation in virtio-crypto (bsc#1255400).\n- CVE-2026-0665: out-of-bounds heap access can lead to a denial of service or potential memory corruption (bsc#1256484).\n- CVE-2026-2243: incorrect bounds check leads to heap out-of-bounds read and a 12-byte information leak when processing\n  specially crafted VMDK files (bsc#1258509).\n- CVE-2026-3195: heap buffer overflow when reading input audio in the virtio-snd device input callback due to\n  insufficient checks in `virtio_snd_pcm_in_cb` (bsc#1259080).\n- CVE-2026-3196: integer overflow in the virtio-snd device via PCM_INFO requests from the guest leads to unbounded\n  memory allocation and host denial-of-service (bsc#1259079).\n- CVE-2026-3842: hyperv/syndbg: missing mapped-length guard after cpu_physical_memory_map causes host OOB write\n  (bsc#1262089).\n","status":"published","published":"2026-05-28T14:52:19Z","modified":"2026-06-03T18:24:24.018223733Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:2386-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- CVE-2025-14876: qemu-kvm: Unbounded allocation in virtio-crypto (bsc#1255400).\n- CVE-2026-0665: out-of-bounds heap access can lead to a denial of service or potential memory corruption (bsc#1256484).\n- CVE-2026-2243: incorrect bounds check leads to heap out-of-bounds read and a 12-byte information leak when processing\n  specially crafted VMDK files (bsc#1258509).\n- CVE-2026-3195: heap buffer overflow when reading input audio in the virtio-snd device input callback due to\n  insufficient checks in `virtio_snd_pcm_in_cb` (bsc#1259080).\n- CVE-2026-3196: integer overflow in the virtio-snd device via PCM_INFO requests from the guest leads to unbounded\n  memory allocation and host denial-of-service (bsc#1259079).\n- CVE-2026-3842: hyperv/syndbg: missing mapped-length guard after cpu_physical_memory_map causes host OOB write\n  (bsc#1262089).\n","status":"published","published":"2026-06-12T13:54:09Z","modified":"2026-06-13T08:00:06.874364567Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"USN-8073-1","title":"qemu vulnerabilities","description":"It was discovered that the UHCI controller implementation of QEMU could be\nbrought into an invalid state. An attacker inside the guest could possibly\nuse this issue to cause QEMU to crash, resulting in a denial of service.\n(CVE-2024-8354)\n\nIt was discovered that QEMU incorrectly handled memory during certain VNC\noperations. An remote attacker could possibly use this issue to cause QEMU\nto crash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2025-11234)\n\nIt was discovered that the e1000 network device implementation of QEMU\ncould be made to write out of bounds. An attacker inside the guest could\npossibly use this issue to cause QEMU to crash, resulting in a denial of\nservice, or possibly execute arbitrary code. This issue only affected\nUbuntu 24.04 LTS and Ubuntu 25.10. (CVE-2025-12464)\n\nIt was discovered that the virtio-crypto device implementation of QEMU did\nnot limit the length of a certain path input. An attacker inside the guest\ncould possibly use this issue to cause QEMU to consume large amount of\nmemory, resulting in a denial of service. This issue only affected Ubuntu\n24.04 LTS and Ubuntu 25.10. (CVE-2025-14876)\n\nIt was discovered that the KVM Xen guest support of QEMU could be made to\nread out of bounds. An attacker inside the guest could possibly use this\nissue to cause QEMU to crash, resulting in a denial of service. This issue\nonly affected Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2026-0665)","status":"published","published":"2026-03-04T16:13:14Z","modified":"2026-04-27T18:47:23.608373839Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}