Qemu vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2024-24474 QEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA transfer length is less than the length of High 8.8 · Feb 20, 2024
• CVE-2020-24165 An issue was discovered in TCG Accelerator in QEMU 4.2.0, allows local attackers to execute arbitrary code, escalate privileges, and cause a denial of service (High 8.8 · Aug 28, 2023
• CVE-2022-36648 The hardware emulation in the of_dpa_cmd_add_l2_flood of rocker device model in QEMU, as used in 7.0.0 and earlier, allows remote attackers to crash the host qeCritical 10 · Aug 22, 2023
• CVE-2023-0664 A flaw was found in the QEMU Guest Agent service for Windows.High 7.8 · Mar 29, 2023
• CVE-2022-3872 An off-by-one read/write issue was found in the SDHCI device of QEMU.High 8.6 · Nov 7, 2022
• CVE-2014-0144 QEMU before 2.0.0 block drivers for CLOOP, QCOW2 version 2 and various other image formats are vulnerable to potential memory corruptions, integer/buffer overflHigh 8.6 · Sep 28, 2022
• CVE-2022-2962 A DMA reentrancy issue was found in the Tulip device emulation in QEMU.High 7.8 · Sep 13, 2022
• CVE-2022-0358 A flaw was found in the QEMU virtio-fs shared file system daemon (virtiofsd) implementation.High 7.8 · Aug 29, 2022
• CVE-2021-3929 A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU.High 8.2 · Aug 25, 2022
• CVE-2022-35414 softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the translate_fail path, leading to an io_readx or io_writex crash.High 8.8 · Jul 10, 2022
• CVE-2021-3750 A DMA reentrancy issue was found in the USB EHCI controller emulation of QEMU.High 8.2 · May 2, 2022
• CVE-2021-4207 A flaw was found in the QXL display device emulation in QEMU.High 8.2 · Apr 29, 2022
• CVE-2021-4206 A flaw was found in the QXL display device emulation in QEMU.High 8.2 · Apr 29, 2022
• CVE-2022-1050 A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device.High 8.8 · Mar 29, 2022
• CVE-2021-3748 A use-after-free vulnerability was found in the virtio-net device of QEMU.High 7.5 · Mar 23, 2022
• CVE-2022-26353 A flaw was found in the virtio-net device of QEMU.High 7.5 · Mar 16, 2022
• CVE-2021-3713 An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0.High 7.4 · Aug 25, 2021
• CVE-2021-3682 A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2.High 8.5 · Aug 5, 2021
• CVE-2021-3546 An out-of-bounds write vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0.High 8.2 · Jun 2, 2021
• CVE-2013-4536 An user able to alter the savevm data (either on the disk or over the wire during migration) could use this flaw to to corrupt QEMU process memory on the (destiHigh 7.8 · May 28, 2021
• CVE-2021-20181 A race condition flaw was found in the 9pfs server implementation of QEMU up to and including 5.2.0.High 7.5 · May 13, 2021
• CVE-2020-35517 A flaw was found in qemu.High 8.2 · Jan 28, 2021
• CVE-2013-4535 The virtqueue_map_sg function in hw/virtio/virtio.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary files via a crafted savevm image, related High 8.8 · Feb 11, 2020
• CVE-2013-4532 Qemu 1.1.2+dfsg to 2.1+dfsg suffers from a buffer overrun which could potentially result in arbitrary code execution on the host with the privileges of the QEMUHigh 7.8 · Jan 2, 2020
• CVE-2019-20175 An issue was discovered in ide_dma_cb() in hw/ide/core.c in QEMU 2.4.0 through 4.2.0.High 7.5 · Dec 30, 2019