CVE-2016-9923

MEDIUM

Qemu < 2.7.1 - Use After Free

Title source: rule

Description

Quick Emulator (Qemu) built with the 'chardev' backend support is vulnerable to a use after free issue. It could occur while hotplug and unplugging the device in the guest. A guest user/process could use this flaw to crash a Qemu process on the host resulting in DoS.

References (3)

Scores

CVSS v3 5.5
EPSS 0.0015
EPSS Percentile 35.6%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Classification

CWE
CWE-416
Status published

Affected Products (2)

qemu/qemu < 2.7.1
n/a/n/a

Timeline

Published Dec 23, 2016
Tracked Since Feb 18, 2026