{"id":"CVE-2026-0665","aliases":["BELL-CVE-2026-0665","DEBIAN-CVE-2026-0665","EUVD-2026-7934","GHSA-4pq4-6gr5-cr69","OESA-2026-1351","OESA-2026-1352","OESA-2026-1354","OESA-2026-1355","SUSE-SU-2026:0445-1","SUSE-SU-2026:0662-1","SUSE-SU-2026:20666-1","SUSE-SU-2026:20693-1","SUSE-SU-2026:20716-1","SUSE-SU-2026:21883-1","SUSE-SU-2026:21912-1","SUSE-SU-2026:2386-1","UBUNTU-CVE-2026-0665","USN-8073-1","openSUSE-SU-2026:10097-1","openSUSE-SU-2026:20357-1"],"status":"published","title":"Qemu-kvm: heap off-by-one in kvm xen physdevop_map_pirq","description":"An off-by-one error was found in QEMU's KVM Xen guest support. A malicious guest could use this flaw to trigger out-of-bounds heap accesses in the QEMU process via the emulated Xen physdev hypercall interface, leading to a denial of service or potential memory corruption.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00168,"percentile":0.0608,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2026-01-14T06:06:12.12698Z","modified":"2026-10-28T02:30:25Z","fixes":[{"ecosystem":"Alpaquita:25","package":"qemu","fixed_in":["10.0.9-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"qemu","fixed_in":["11.0.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"qemu","fixed_in":["1:10.0.8+ds-0+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"qemu","fixed_in":["1:10.2.0+ds-2"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"qemu","fixed_in":["8.2.0-67.oe2403sp3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"qemu","fixed_in":["9.2.4-150700.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"qemu","fixed_in":["9.2.4-150700.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"qemu-linux-user","fixed_in":["9.2.4-150700.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"qemu","fixed_in":["9.2.4-150700.3.14.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"qemu","fixed_in":["1:8.2.2+ds-0ubuntu1.13"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"qemu","fixed_in":["1:10.1.0+ds-5ubuntu2.4"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"qemu","fixed_in":["10.2.0-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:25","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-r1"},{"fixed":"10.0.9-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.2-r0"},{"fixed":"11.0.0-r0"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.0.8+ds-0+deb13u1"}]}],"versions":["1:10.0.2+ds-2","1:10.0.2+ds-2+deb13u1","1:10.0.2+ds-2+deb13u1~bpo12+1","1:10.0.3+ds-0+deb13u1","1:10.0.3+ds-1","1:10.0.3+ds-2","1:10.0.3+ds-3","1:10.0.3+ds-4","1:10.0.6+ds-0+deb13u1","1:10.0.6+ds-0+deb13u2","1:10.0.7+ds-0+deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.2.0+ds-2"}]}],"versions":["1:10.0.2+ds-2","1:10.0.3+ds-1","1:10.0.3+ds-2","1:10.0.3+ds-3","1:10.0.3+ds-4","1:10.1.0+ds-1","1:10.1.0+ds-2","1:10.1.0+ds-3","1:10.1.0+ds-4","1:10.1.0+ds-5","1:10.1.0~rc0+ds-1","1:10.1.0~rc0+ds-2","1:10.1.0~rc0+ds-3","1:10.1.0~rc0+ds-4","1:10.1.0~rc1+ds-1","1:10.1.0~rc1+ds-1a","1:10.1.0~rc1+ds-1b","1:10.1.0~rc1+ds-2","1:10.1.0~rc1+ds-3","1:10.1.0~rc2+ds-1","1:10.1.0~rc3+ds-1","1:10.1.0~rc3+ds-2","1:10.1.1+ds-1","1:10.1.2+ds-1","1:10.1.2+ds-2","1:10.1.2+ds-3","1:10.1.3+ds-1","1:10.2.0+ds-1","1:10.2.0~rc1+ds-1"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.0-54.oe2403sp2"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.0-67.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.0-53.oe2403"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.0-53.oe2403sp1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.4-150700.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.4-150700.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"qemu-linux-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.4-150700.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.4-150700.3.14.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.10-150600.3.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"qemu-linux-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.10-150600.3.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.10-slfo.1.1_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.8-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.10-2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.10-150600.3.49.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.10-150600.3.49.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.2.2+ds-0ubuntu1.13"}]}],"versions":["1:8.0.4+dfsg-1ubuntu3","1:8.0.4+dfsg-1ubuntu4","1:8.0.4+dfsg-1ubuntu5","1:8.1.3+ds-1ubuntu2","1:8.2.1+ds-1ubuntu1","1:8.2.1+ds-1ubuntu8","1:8.2.1+ds-1ubuntu9","1:8.2.2+ds-0ubuntu1","1:8.2.2+ds-0ubuntu1.2","1:8.2.2+ds-0ubuntu1.4","1:8.2.2+ds-0ubuntu1.5","1:8.2.2+ds-0ubuntu1.6","1:8.2.2+ds-0ubuntu1.7","1:8.2.2+ds-0ubuntu1.8","1:8.2.2+ds-0ubuntu1.9","1:8.2.2+ds-0ubuntu1.10","1:8.2.2+ds-0ubuntu1.11","1:8.2.2+ds-0ubuntu1.12"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.0+ds-5ubuntu2.4"}]}],"versions":["1:9.2.1+ds-1ubuntu5","1:10.0.2+ds-1ubuntu1","1:10.0.2+ds-1ubuntu2","1:10.1.0+ds-1ubuntu1","1:10.1.0+ds-5ubuntu1","1:10.1.0+ds-5ubuntu2","1:10.1.0+ds-5ubuntu2.1","1:10.1.0+ds-5ubuntu2.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.2+dfsg-2ubuntu6.28"}]}],"versions":["1:6.0+dfsg-2expubuntu1","1:6.0+dfsg-2expubuntu2","1:6.0+dfsg-2expubuntu4","1:6.2+dfsg-2ubuntu5","1:6.2+dfsg-2ubuntu6","1:6.2+dfsg-2ubuntu6.1","1:6.2+dfsg-2ubuntu6.2","1:6.2+dfsg-2ubuntu6.3","1:6.2+dfsg-2ubuntu6.4","1:6.2+dfsg-2ubuntu6.5","1:6.2+dfsg-2ubuntu6.6","1:6.2+dfsg-2ubuntu6.7","1:6.2+dfsg-2ubuntu6.8","1:6.2+dfsg-2ubuntu6.9","1:6.2+dfsg-2ubuntu6.10","1:6.2+dfsg-2ubuntu6.11","1:6.2+dfsg-2ubuntu6.12","1:6.2+dfsg-2ubuntu6.13","1:6.2+dfsg-2ubuntu6.14","1:6.2+dfsg-2ubuntu6.15","1:6.2+dfsg-2ubuntu6.16","1:6.2+dfsg-2ubuntu6.17","1:6.2+dfsg-2ubuntu6.18","1:6.2+dfsg-2ubuntu6.19","1:6.2+dfsg-2ubuntu6.21","1:6.2+dfsg-2ubuntu6.22","1:6.2+dfsg-2ubuntu6.23","1:6.2+dfsg-2ubuntu6.24","1:6.2+dfsg-2ubuntu6.25","1:6.2+dfsg-2ubuntu6.26","1:6.2+dfsg-2ubuntu6.27"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.2.2+ds-0ubuntu1.13"}]}],"versions":["1:8.0.4+dfsg-1ubuntu3","1:8.0.4+dfsg-1ubuntu4","1:8.0.4+dfsg-1ubuntu5","1:8.1.3+ds-1ubuntu2","1:8.2.1+ds-1ubuntu1","1:8.2.1+ds-1ubuntu8","1:8.2.1+ds-1ubuntu9","1:8.2.2+ds-0ubuntu1","1:8.2.2+ds-0ubuntu1.2","1:8.2.2+ds-0ubuntu1.4","1:8.2.2+ds-0ubuntu1.5","1:8.2.2+ds-0ubuntu1.6","1:8.2.2+ds-0ubuntu1.7","1:8.2.2+ds-0ubuntu1.8","1:8.2.2+ds-0ubuntu1.9","1:8.2.2+ds-0ubuntu1.10","1:8.2.2+ds-0ubuntu1.11","1:8.2.2+ds-0ubuntu1.12"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.0+ds-5ubuntu2.4"}]}],"versions":["1:9.2.1+ds-1ubuntu5","1:10.0.2+ds-1ubuntu1","1:10.0.2+ds-1ubuntu2","1:10.1.0+ds-1ubuntu1","1:10.1.0+ds-5ubuntu1","1:10.1.0+ds-5ubuntu2","1:10.1.0+ds-5ubuntu2.1","1:10.1.0+ds-5ubuntu2.2"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.0-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.8-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"qemu-linux-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.8-160000.1.1"}]}],"bundled":2}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat openshift container platform 4"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-0665","tags":["vdb-entry","x_refsource_REDHAT","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2428640","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0665","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4pq4-6gr5-cr69"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-0665","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/0xxx/CVE-2026-0665.json","tags":["advisory"]},{"url":"https://gitlab.com/qemu-project/qemu","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-0665","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1351","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-11234","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-12464","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1352","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1354","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1355","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260445-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1256484","tags":["report"]},{"url":"https://bugzilla.suse.com/1257474","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-0665","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260662-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1255400","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-14876","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620666-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620693-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1257492","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620716-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621883-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1258509","tags":["report"]},{"url":"https://bugzilla.suse.com/1259079","tags":["report"]},{"url":"https://bugzilla.suse.com/1259080","tags":["report"]},{"url":"https://bugzilla.suse.com/1262089","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2243","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3196","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3842","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621912-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262386-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1199023","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-0665","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-0665","tags":["report"]},{"url":"https://lore.kernel.org/qemu-devel/13FE03BE60EA78D6+20260109023548.4047-1-vr@darknavy.com/","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8073-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-8354","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-11234","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-12464","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-14876","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-0665","title":"Qemu-kvm: heap off-by-one in kvm xen physdevop_map_pirq","description":"An off-by-one error was found in QEMU's KVM Xen guest support. A malicious guest could use this flaw to trigger out-of-bounds heap accesses in the QEMU process via the emulated Xen physdev hypercall interface, leading to a denial of service or potential memory corruption.","status":"published","published":"2026-02-18T20:50:03.724Z","modified":"2026-02-18T21:27:14.216Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:20:13.587351Z"}],"euvd":[{"id":"EUVD-2026-7934","description":"An off-by-one error was found in QEMU's KVM Xen guest support. A malicious guest could use this flaw to trigger out-of-bounds heap accesses in the QEMU process via the emulated Xen physdev hypercall interface, leading to a denial of service or potential memory corruption.","status":"published","published":"2026-02-18T20:50:03Z","modified":"2026-02-18T21:27:14Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T19:48:37.43406Z"}],"ghsa":[{"id":"GHSA-4pq4-6gr5-cr69","title":"An off-by-one error was found in QEMU's KVM Xen guest support. A malicious guest could use this...","description":"An off-by-one error was found in QEMU's KVM Xen guest support. A malicious guest could use this flaw to trigger out-of-bounds heap accesses in the QEMU process via the emulated Xen physdev hypercall interface, leading to a denial of service or potential memory corruption.","status":"published","published":"2026-02-18T21:31:23Z","modified":"2026-02-18T21:31:34Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:06:15.594622Z"}],"nvd":[{"id":"CVE-2026-0665","description":"An off-by-one error was found in QEMU's KVM Xen guest support. A malicious guest could use this flaw to trigger out-of-bounds heap accesses in the QEMU process via the emulated Xen physdev hypercall interface, leading to a denial of service or potential memory corruption.","status":"published","published":"2026-02-18T21:16:22.633Z","modified":"2026-06-17T10:11:10.45Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:12:06.274729Z"}],"osv":[{"id":"BELL-CVE-2026-0665","status":"published","published":"2026-01-14T06:06:12.12698Z","modified":"2026-08-15T07:15:08.097212441Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:23.037038Z"},{"id":"CVE-2026-0665","title":"Qemu-kvm: heap off-by-one in kvm xen physdevop_map_pirq","description":"An off-by-one error was found in QEMU's KVM Xen guest support. A malicious guest could use this flaw to trigger out-of-bounds heap accesses in the QEMU process via the emulated Xen physdev hypercall interface, leading to a denial of service or potential memory corruption.","status":"published","published":"2026-02-18T20:50:03.724Z","modified":"2026-10-28T02:30:25.668668993Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:44:53.490346Z"},{"id":"DEBIAN-CVE-2026-0665","description":"An off-by-one error was found in QEMU's KVM Xen guest support. A malicious guest could use this flaw to trigger out-of-bounds heap accesses in the QEMU process via the emulated Xen physdev hypercall interface, leading to a denial of service or potential memory corruption.","status":"published","published":"2026-02-18T21:16:22.633Z","modified":"2026-10-01T03:00:11.818686726Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:48.440897Z"},{"id":"OESA-2026-1351","title":"qemu security update","description":"QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication.(CVE-2025-11234)\n\nA stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and moved to the net core code. The issue stems from the device\u0026apos;s receive code still being able to process a short frame in loopback mode. This could lead to a buffer overrun in the e1000_receive_iov() function via the loopback code path. A malicious guest user could use this vulnerability to crash the QEMU process on the host, resulting in a denial of service.(CVE-2025-12464)\n\nAn \u0026amp;quot;off by one\u0026amp;quot; bug has been discovered in QEMU\u0026amp;#39;s KVM Xen guest support. A malicious client could exploit this vulnerability to trigger an out-of-bounds heap access in the QEMU process via the simulated Xen physical device overshoot interface, resulting in a denial of service or potential memory corruption.(CVE-2026-0665)","status":"published","published":"2026-02-13T11:10:22Z","modified":"2026-08-18T01:19:32.567000307Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1352","title":"qemu security update","description":"QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.\r\n\r\nSecurity Fix(es):\n\nAn \u0026amp;quot;off by one\u0026amp;quot; bug has been discovered in QEMU\u0026amp;#39;s KVM Xen guest support. A malicious client could exploit this vulnerability to trigger an out-of-bounds heap access in the QEMU process via the simulated Xen physical device overshoot interface, resulting in a denial of service or potential memory corruption.(CVE-2026-0665)","status":"published","published":"2026-02-13T11:10:22Z","modified":"2026-08-18T01:19:32.933554676Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1354","title":"qemu security update","description":"QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication.(CVE-2025-11234)\n\nA stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and moved to the net core code. The issue stems from the device\u0026apos;s receive code still being able to process a short frame in loopback mode. This could lead to a buffer overrun in the e1000_receive_iov() function via the loopback code path. A malicious guest user could use this vulnerability to crash the QEMU process on the host, resulting in a denial of service.(CVE-2025-12464)\n\nAn \u0026amp;quot;off by one\u0026amp;quot; bug has been discovered in QEMU\u0026amp;#39;s KVM Xen guest support. A malicious client could exploit this vulnerability to trigger an out-of-bounds heap access in the QEMU process via the simulated Xen physical device overshoot interface, resulting in a denial of service or potential memory corruption.(CVE-2026-0665)","status":"published","published":"2026-02-13T11:10:23Z","modified":"2026-08-18T01:19:32.46224106Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1355","title":"qemu security update","description":"QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication.(CVE-2025-11234)\n\nA stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and moved to the net core code. The issue stems from the device\u0026apos;s receive code still being able to process a short frame in loopback mode. This could lead to a buffer overrun in the e1000_receive_iov() function via the loopback code path. A malicious guest user could use this vulnerability to crash the QEMU process on the host, resulting in a denial of service.(CVE-2025-12464)\n\nAn \u0026amp;quot;off by one\u0026amp;quot; bug has been discovered in QEMU\u0026amp;#39;s KVM Xen guest support. A malicious client could exploit this vulnerability to trigger an out-of-bounds heap access in the QEMU process via the simulated Xen physical device overshoot interface, resulting in a denial of service or potential memory corruption.(CVE-2026-0665)","status":"published","published":"2026-02-13T11:10:23Z","modified":"2026-08-18T01:19:32.601563691Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"UBUNTU-CVE-2026-0665","description":"An off-by-one error was found in QEMU's KVM Xen guest support. A malicious guest could use this flaw to trigger out-of-bounds heap accesses in the QEMU process via the emulated Xen physdev hypercall interface, leading to a denial of service or potential memory corruption.","status":"published","published":"2026-02-18T21:16:00Z","modified":"2026-03-05T19:18:31.951642Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:55:58.519486Z"},{"id":"openSUSE-SU-2026:10097-1","title":"qemu-10.2.0-2.1 on GA media","description":"These are all security issues fixed in the qemu-10.2.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-01-26T00:00:00Z","modified":"2026-03-23T04:54:27.078829Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:20357-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- Update to version 10.0.8\n- CVE-2025-14876: Fixed unbounded allocation in virtio-crypto. (bsc#1255400)\n- CVE-2026-0665: Fixed PIRQ bounds check in xen_physdev_map_pirq. (bsc#1256484)\n","status":"published","published":"2026-03-13T10:47:15Z","modified":"2026-03-23T04:54:51.307873Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:0445-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- CVE-2026-0665: Added PIRQ bounds check in xen_physdev_map_pirq to avoid an out-of-bounds heap. (bsc#1256484)\n\nOther fixes:\n\n- Fixed that QEMU migration fails if a qemu-vdagent channel is present in the VM (bsc#1257474)\n","status":"published","published":"2026-02-11T10:20:02Z","modified":"2026-03-23T04:52:15.510098Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0662-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- CVE-2025-14876: qemu-kvm: Unbounded allocation in virtio-crypto (bsc#1255400).\n- CVE-2026-0665: out-of-bounds heap access can lead to a denial of service or potential memory corruption (bsc#1256484).\n","status":"published","published":"2026-02-26T15:12:26Z","modified":"2026-03-23T04:52:24.176442Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:20666-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- CVE-2025-14876: Fixed unbounded allocation in virtio-crypto. (bsc#1255400)\n- CVE-2026-0665: Fixed PIRQ bounds check in xen_physdev_map_pirq. (bsc#1256484)\n","status":"published","published":"2026-03-11T11:28:39Z","modified":"2026-03-23T04:53:06.964966Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:20693-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- Update to version 10.0.8\n- CVE-2025-14876: Fixed unbounded allocation in virtio-crypto. (bsc#1255400)\n- CVE-2026-0665: Fixed PIRQ bounds check in xen_physdev_map_pirq. (bsc#1256484)\n","status":"published","published":"2026-03-13T10:41:36Z","modified":"2026-03-23T04:53:08.593858Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:20716-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- CVE-2025-14876: Fixed unbounded allocation in virtio-crypto. (bsc#1255400)\n- CVE-2026-0665: Fixed PIRQ bounds check in xen_physdev_map_pirq. (bsc#1256484)\n","status":"published","published":"2026-03-10T18:34:11Z","modified":"2026-03-23T04:53:09.136598Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:21883-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues\n\n- CVE-2025-14876: qemu-kvm: Unbounded allocation in virtio-crypto (bsc#1255400).\n- CVE-2026-0665: out-of-bounds heap access can lead to a denial of service or potential memory corruption (bsc#1256484).\n- CVE-2026-2243: incorrect bounds check leads to heap out-of-bounds read and a 12-byte information leak when processing\n  specially crafted VMDK files (bsc#1258509).\n- CVE-2026-3195: heap buffer overflow when reading input audio in the virtio-snd device input callback due to\n  insufficient checks in `virtio_snd_pcm_in_cb` (bsc#1259080).\n- CVE-2026-3196: integer overflow in the virtio-snd device via PCM_INFO requests from the guest leads to unbounded\n  memory allocation and host denial-of-service (bsc#1259079).\n- CVE-2026-3842: hyperv/syndbg: missing mapped-length guard after cpu_physical_memory_map causes host OOB write\n  (bsc#1262089).\n","status":"published","published":"2026-06-01T13:45:56Z","modified":"2026-06-03T18:24:40.689343957Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:21912-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues\n\n- CVE-2025-14876: qemu-kvm: Unbounded allocation in virtio-crypto (bsc#1255400).\n- CVE-2026-0665: out-of-bounds heap access can lead to a denial of service or potential memory corruption (bsc#1256484).\n- CVE-2026-2243: incorrect bounds check leads to heap out-of-bounds read and a 12-byte information leak when processing\n  specially crafted VMDK files (bsc#1258509).\n- CVE-2026-3195: heap buffer overflow when reading input audio in the virtio-snd device input callback due to\n  insufficient checks in `virtio_snd_pcm_in_cb` (bsc#1259080).\n- CVE-2026-3196: integer overflow in the virtio-snd device via PCM_INFO requests from the guest leads to unbounded\n  memory allocation and host denial-of-service (bsc#1259079).\n- CVE-2026-3842: hyperv/syndbg: missing mapped-length guard after cpu_physical_memory_map causes host OOB write\n  (bsc#1262089).\n","status":"published","published":"2026-05-28T14:52:19Z","modified":"2026-06-03T18:24:24.018223733Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:2386-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- CVE-2025-14876: qemu-kvm: Unbounded allocation in virtio-crypto (bsc#1255400).\n- CVE-2026-0665: out-of-bounds heap access can lead to a denial of service or potential memory corruption (bsc#1256484).\n- CVE-2026-2243: incorrect bounds check leads to heap out-of-bounds read and a 12-byte information leak when processing\n  specially crafted VMDK files (bsc#1258509).\n- CVE-2026-3195: heap buffer overflow when reading input audio in the virtio-snd device input callback due to\n  insufficient checks in `virtio_snd_pcm_in_cb` (bsc#1259080).\n- CVE-2026-3196: integer overflow in the virtio-snd device via PCM_INFO requests from the guest leads to unbounded\n  memory allocation and host denial-of-service (bsc#1259079).\n- CVE-2026-3842: hyperv/syndbg: missing mapped-length guard after cpu_physical_memory_map causes host OOB write\n  (bsc#1262089).\n","status":"published","published":"2026-06-12T13:54:09Z","modified":"2026-06-13T08:00:06.874364567Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"USN-8073-1","title":"qemu vulnerabilities","description":"It was discovered that the UHCI controller implementation of QEMU could be\nbrought into an invalid state. An attacker inside the guest could possibly\nuse this issue to cause QEMU to crash, resulting in a denial of service.\n(CVE-2024-8354)\n\nIt was discovered that QEMU incorrectly handled memory during certain VNC\noperations. An remote attacker could possibly use this issue to cause QEMU\nto crash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2025-11234)\n\nIt was discovered that the e1000 network device implementation of QEMU\ncould be made to write out of bounds. An attacker inside the guest could\npossibly use this issue to cause QEMU to crash, resulting in a denial of\nservice, or possibly execute arbitrary code. This issue only affected\nUbuntu 24.04 LTS and Ubuntu 25.10. (CVE-2025-12464)\n\nIt was discovered that the virtio-crypto device implementation of QEMU did\nnot limit the length of a certain path input. An attacker inside the guest\ncould possibly use this issue to cause QEMU to consume large amount of\nmemory, resulting in a denial of service. This issue only affected Ubuntu\n24.04 LTS and Ubuntu 25.10. (CVE-2025-14876)\n\nIt was discovered that the KVM Xen guest support of QEMU could be made to\nread out of bounds. An attacker inside the guest could possibly use this\nissue to cause QEMU to crash, resulting in a denial of service. This issue\nonly affected Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2026-0665)","status":"published","published":"2026-03-04T16:13:14Z","modified":"2026-04-27T18:47:23.608373839Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}