Description
A flaw was found in the QXL display device emulation in QEMU. A double fetch of guest controlled values `cursor->header.width` and `cursor->header.height` can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer overflow. A malicious privileged guest user could use this flaw to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QEMU process.
References (6)
Core 6
Core References
Issue Tracking, Third Party Advisory x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=2036966
Exploit, Third Party Advisory x_refsource_misc
https://starlabs.sg/advisories/21-4207/
Third Party Advisory vendor-advisory
x_refsource_debian
https://www.debian.org/security/2022/dsa-5133
Third Party Advisory vendor-advisory
x_refsource_gentoo
https://security.gentoo.org/glsa/202208-27
Mailing List, Third Party Advisory mailing-list
x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html
Vendor Advisory
https://security.netapp.com/advisory/ntap-20250321-0009/
Scores
CVSS v3
8.2
EPSS
0.0005
EPSS Percentile
15.8%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Details
CWE
CWE-362
CWE-120
Status
published
Products (4)
debian/debian_linux
10.0
debian/debian_linux
11.0
qemu/qemu
< 7.0.0
redhat/enterprise_linux
8.0 (2 CPE variants)
Published
Apr 29, 2022
Tracked Since
Feb 18, 2026