CVE-2026-6426
MediumCVSS 4.4Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
In QEMU, a type mismatch vulnerability exists in vhost inflight migration VMState handling. The destination buffer size is stored as uint64_t but read as int32_t, which on little-endian hosts can lead to out-of-bounds reads and crash of the QEMU process or memory corruption. Exploitation requires control of the migration producer or write access to the migration channel.
Risk Assessment
Potential for virtual machine crashes or memory corruption, which could lead to service disruptions and potential data integrity compromise.
Recommendation
Upgrade QEMU to a patched version. Restrict access to the migration channel and ensure only trusted sources can initiate migration.
Other vulnerabilities in QEMU
See all- CVE-2015-7504High
Heap-based buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU allows guest OS administrators to cause a denial of service (instance crash) or possibly execute arbitrary code via a series of packets in loopback mode.
- CVE-2017-15268High
Qemu through 2.10.0 allows remote attackers to cause a memory leak by triggering slow data-channel read operations, related to io/channel-websock.c.
- CVE-2017-13711High
A use-after-free vulnerability in the sofree function in slirp/socket.c in QEMU allows attackers to cause a denial of service (QEMU instance crash) by failing to properly clear ifq_so from pending packets.
- CVE-2014-0145High
Multiple buffer overflows in QEMU before 1.7.2 and 2.x before 2.0.0 allow local users to cause a denial of service (crash) or possibly execute arbitrary code via a large L1 table in the qcow2_snapshot_load_tmp in the QCOW 2 block driver or various parameters in the DMG block driver.
- CVE-2014-0143High
Multiple integer overflows in QEMU, before version 2.0.0, allow local users to cause a denial of service (crash) by providing crafted input, leading to buffer overflows and memory corruption.
- CVE-2017-10664High
qemu-nbd in QEMU does not ignore SIGPIPE, allowing remote attackers to cause a denial of service (daemon crash) by disconnecting during a server-to-client reply attempt.
- CVE-2017-8309High
A memory leak in audio/audio.c in QEMU allows remote attackers to cause a denial of service by repeatedly starting and stopping audio capture.
- CVE-2017-8284High
The disas_insn function in QEMU before version 2.9.0 does not limit instruction size in TCG mode without hardware acceleration, allowing local users to gain privileges by creating a modified basic block that injects code into a setuid program.
- CVE-2015-8619High
The Human Monitor Interface support in QEMU allows remote attackers to cause a denial of service through out-of-bounds write and application crash.
- CVE-2015-8567High
A memory leak in QEMU's net/vmxnet3.c allows remote attackers to cause a denial of service through excessive memory consumption.
Original NVD description (English source)
A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size is stored as a uint64_t but read by the VMS_VBUFFER load path as a signed int32_t. On little-endian hosts, a crafted incoming migration state with bit 31 set causes the value to be interpreted as negative and then implicitly converted to a very large size_t, leading qemu_get_buffer() to copy migration-stream data beyond the bounds of the mmap-backed inflight region. This can result in a crash of the QEMU process or memory corruption. Exploitation requires control of the migration producer or write access to the migration channel, combined with a destination configured to use vhost inflight migration.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS