{"id":"CVE-2026-48915","aliases":["BELL-CVE-2026-48915","DEBIAN-CVE-2026-48915","UBUNTU-CVE-2026-48915"],"status":"published","description":"hw/uefi: fix parse_hexstr","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-06-28T08:48:14.865554092Z","modified":"2026-10-22T23:20:19Z","fixes":[{"ecosystem":"Alpaquita:25","package":"qemu","fixed_in":["10.0.12-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"qemu","fixed_in":["11.0.2-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"qemu","fixed_in":["1:10.0.11+ds-0+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"qemu","fixed_in":["1:11.0.2+ds-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:25","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-r1"},{"fixed":"10.0.12-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.2-r0"},{"fixed":"11.0.2-r0"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.0.11+ds-0+deb13u1"}]}],"versions":["1:10.0.10+ds-0+deb13u1","1:10.0.2+ds-2","1:10.0.2+ds-2+deb13u1","1:10.0.2+ds-2+deb13u1~bpo12+1","1:10.0.3+ds-0+deb13u1","1:10.0.3+ds-1","1:10.0.3+ds-2","1:10.0.3+ds-3","1:10.0.3+ds-4","1:10.0.6+ds-0+deb13u1","1:10.0.6+ds-0+deb13u2","1:10.0.7+ds-0+deb13u1","1:10.0.8+ds-0+deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.2+ds-1"}]}],"versions":["1:10.0.2+ds-2","1:10.0.3+ds-1","1:10.0.3+ds-2","1:10.0.3+ds-3","1:10.0.3+ds-4","1:10.1.0+ds-1","1:10.1.0+ds-2","1:10.1.0+ds-3","1:10.1.0+ds-4","1:10.1.0+ds-5","1:10.1.0~rc0+ds-1","1:10.1.0~rc0+ds-2","1:10.1.0~rc0+ds-3","1:10.1.0~rc0+ds-4","1:10.1.0~rc1+ds-1","1:10.1.0~rc1+ds-1a","1:10.1.0~rc1+ds-1b","1:10.1.0~rc1+ds-2","1:10.1.0~rc1+ds-3","1:10.1.0~rc2+ds-1","1:10.1.0~rc3+ds-1","1:10.1.0~rc3+ds-2","1:10.1.1+ds-1","1:10.1.2+ds-1","1:10.1.2+ds-2","1:10.1.2+ds-3","1:10.1.3+ds-1","1:10.2.0+ds-1","1:10.2.0+ds-2","1:10.2.0~rc1+ds-1","1:10.2.1+ds-1","1:10.2.2+ds-1","1:11.0.0+ds-1","1:11.0.0+ds-2","1:11.0.0~rc0+ds-1","1:11.0.0~rc0+ds-2","1:11.0.0~rc1+ds-1","1:11.0.0~rc1+ds-2","1:11.0.0~rc1+ds-3","1:11.0.0~rc2+ds-1","1:11.0.0~rc2+ds-2","1:11.0.0~rc3+ds-1","1:11.0.1+ds-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:9.2.1+ds-1ubuntu5","1:10.0.2+ds-1ubuntu1","1:10.0.2+ds-1ubuntu2","1:10.1.0+ds-1ubuntu1","1:10.1.0+ds-5ubuntu1","1:10.1.0+ds-5ubuntu2","1:10.1.0+ds-5ubuntu2.1","1:10.1.0+ds-5ubuntu2.2","1:10.1.0+ds-5ubuntu2.4","1:10.1.0+ds-5ubuntu2.5","1:10.1.0+ds-5ubuntu2.6","1:10.1.0+ds-5ubuntu2.7"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.2.1+ds-1ubuntu3","1:10.2.1+ds-1ubuntu6","1:11.0.3+ds-2ubuntu1","1:11.0.3+ds-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"qemu-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.2.1+ds-1ubuntu4","1:10.2.1+ds-1ubuntu7","1:10.2.1+ds-1ubuntu8","1:11.0.3+ds-2ubuntu2","1:11.0.3+ds-2ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.1.0+ds-5ubuntu2","1:10.1.0+ds-5ubuntu3","1:10.1.0+ds-5ubuntu4","1:10.1.0+ds-5ubuntu5","1:10.2.1+ds-1ubuntu1","1:10.2.1+ds-1ubuntu2","1:10.2.1+ds-1ubuntu3","1:10.2.1+ds-1ubuntu3.1","1:10.2.1+ds-1ubuntu3.2","1:10.2.1+ds-1ubuntu3.3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"qemu-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.2.1+ds-1ubuntu2","1:10.2.1+ds-1ubuntu4","1:10.2.1+ds-1ubuntu4.2","1:10.2.1+ds-1ubuntu4.3","1:10.2.1+ds-1ubuntu4.4"]}],"references":[{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-48915","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-48915","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-48915","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48915","tags":["report"]}],"sources":{"osv":[{"id":"BELL-CVE-2026-48915","status":"published","published":"2026-07-01T06:04:44.593643Z","modified":"2026-08-15T07:15:10.541989728Z","updated_at":"2026-11-02T15:28:24.391068Z"},{"id":"DEBIAN-CVE-2026-48915","status":"published","published":"2026-06-28T08:48:14.865554092Z","modified":"2026-07-14T05:00:28.249191811Z","updated_at":"2026-11-02T15:45:56.444225Z"},{"id":"UBUNTU-CVE-2026-48915","description":"hw/uefi: fix parse_hexstr","status":"published","published":"2026-06-29T00:00:00Z","modified":"2026-10-22T23:20:19.675983454Z","updated_at":"2026-11-02T16:56:33.391918Z"}]}}