{"id":"CVE-2026-5164","aliases":["EUVD-2026-17111","GHSA-6457-73j6-h3qg"],"status":"published","title":"Virtio-win: virtio-win: denial of service via unvalidated descriptor count in unmap request","description":"A flaw was found in virtio-win. The `RhelDoUnMap()` function does not properly validate the number of descriptors provided by a user during an unmap request. A local user could exploit this input validation vulnerability by supplying an excessive number of descriptors, leading to a buffer overrun. This can cause a system crash, resulting in a Denial of Service (DoS).","severity":{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00114,"percentile":0.01472,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-120"],"published":"2026-03-30T15:02:21Z","modified":"2026-11-05T21:17:52Z","products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"redhat","product":"virtio-win"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-5164","tags":["vdb-entry","x_refsource_REDHAT","Vendor Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453014","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","Vendor Advisory"]},{"url":"https://github.com/virtio-win/kvm-guest-drivers-windows/pull/1504","tags":["Issue Tracking","Patch"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5164"},{"url":"https://github.com/advisories/GHSA-6457-73j6-h3qg"}],"sources":{"cve":[{"id":"CVE-2026-5164","title":"Virtio-win: virtio-win: denial of service via unvalidated descriptor count in unmap request","description":"A flaw was found in virtio-win. The `RhelDoUnMap()` function does not properly validate the number of descriptors provided by a user during an unmap request. A local user could exploit this input validation vulnerability by supplying an excessive number of descriptors, leading to a buffer overrun. This can cause a system crash, resulting in a Denial of Service (DoS).","status":"published","published":"2026-03-30T15:02:21.663Z","modified":"2026-11-05T21:17:52.506Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-120"],"updated_at":"2026-11-05T22:55:20.139479Z"}],"euvd":[{"id":"EUVD-2026-17111","description":"A flaw was found in virtio-win. The `RhelDoUnMap()` function does not properly validate the number of descriptors provided by a user during an unmap request. A local user could exploit this input validation vulnerability by supplying an excessive number of descriptors, leading to a buffer overrun. This can cause a system crash, resulting in a Denial of Service (DoS).","status":"published","published":"2026-03-30T15:02:21Z","modified":"2026-11-05T21:17:52Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-05T22:02:08.543452Z"}],"ghsa":[{"id":"GHSA-6457-73j6-h3qg","title":"A flaw was found in virtio-win. The `RhelDoUnMap()` function does not properly validate the...","description":"A flaw was found in virtio-win. The `RhelDoUnMap()` function does not properly validate the number of descriptors provided by a user during an unmap request. A local user could exploit this input validation vulnerability by supplying an excessive number of descriptors, leading to a buffer overrun. This can cause a system crash, resulting in a Denial of Service (DoS).","status":"published","published":"2026-03-30T15:32:07Z","modified":"2026-03-30T15:32:13Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T15:06:55.220248Z"}],"nvd":[{"id":"CVE-2026-5164","description":"A flaw was found in virtio-win. The `RhelDoUnMap()` function does not properly validate the number of descriptors provided by a user during an unmap request. A local user could exploit this input validation vulnerability by supplying an excessive number of descriptors, leading to a buffer overrun. This can cause a system crash, resulting in a Denial of Service (DoS).","status":"published","published":"2026-03-30T15:16:36.18Z","modified":"2026-11-05T22:18:50.163Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-120"],"updated_at":"2026-11-05T23:57:17.922269Z"}]}}