CVE-2026-3195: QEMU Virtio-Snd Heap Out-of-Bounds Write (HIGH)

Technical summary

The `virtio_snd_pcm_in_cb` function in QEMU's virtio-snd (virtual sound) device handles incoming audio PCM data from the host. The function processes I/O vectors (iov) containing audio samples but does not adequately validate that the provided iov size will fit within the destination data buffer before performing the write. This classic heap out-of-bounds write (CWE-122) allows an attacker to overwrite adjacent heap structures. The root cause is an incomplete remediation of CVE-2024-7730, suggesting the prior patch addressed symptoms but not the underlying boundary-checking logic. The vulnerability requires local access (either guest-level or host-level depending on the attack vector) and occurs during audio stream setup or processing.

Business impact

Exploitation could allow an attacker with local access to a QEMU virtual machine to compromise the hypervisor or guest kernel, depending on privilege context. This threatens confidentiality (reading sensitive memory), integrity (modifying heap structures to alter program behavior), and availability (triggering crashes). Organizations running QEMU for virtualization—particularly those using it for multi-tenant cloud platforms, containerization, or development environments—face risk of privilege escalation, guest-to-host escape, or lateral movement across VMs sharing the same host. The impact is especially acute if audio passthrough or input is enabled in production environments, which is uncommon but possible in specialized use cases (voice processing, multimedia applications).

Affected systems

QEMU is affected across all versions prior to patching. No version constraints were specified in the source data, indicating the need to verify patch availability from QEMU security advisories. Organizations should assume all active QEMU deployments are potentially vulnerable unless updated. Virtual sound device (virtio-snd) must be enabled in the QEMU guest configuration for the vulnerability to be exploitable; many deployments disable audio by default, reducing exposure. Hypervisors and cloud platforms using QEMU (such as KVM/libvirt, OpenStack with QEMU backends, or custom virtualization solutions) should assess which guests have audio input capability enabled.

Exploitability

Exploitation requires local access to either the QEMU host or a guest VM with audio input configured. The CVSS vector (AV:L) reflects local-only attack surface. Attackers cannot exploit this remotely or from an unauthenticated network position. However, the low complexity (AC:H) suggests the trigger may require specific conditions (e.g., starting audio capture or crafting particular PCM frames), but once achieved, the outcome is reliable. Guest-to-host escape via this vector would require coordination with or compromise of the guest OS, elevating the attack bar slightly. The incomplete prior fix (CVE-2024-7730) suggests this class of vulnerability may recur if patching is not thorough; security teams should scrutinize the vendor's remediation approach.

Remediation

Monitor QEMU security advisories for patches addressing CVE-2026-3195. Patching should be prioritized for systems where audio input is enabled or where guest-to-host isolation is a critical control. Temporary mitigations include: (1) disabling audio devices (virtio-snd, AC97, ES1370) in QEMU configurations for VMs that do not require audio; (2) restricting guest kernel or hypervisor privileges where possible; (3) running QEMU with minimal privileges and seccomp/AppArmor confinement; (4) isolating audio-capable VMs on dedicated hardware or network segments. These mitigations are most effective when combined with prompt patching.

Patch guidance

When patches become available, verify version numbers and deployment scope against your QEMU inventory. Test patches in non-production environments first, particularly on systems with audio passthrough or complex guest configurations. The patch should comprehensively address iov boundary validation in `virtio_snd_pcm_in_cb` and any related audio input callbacks. Given this is an incomplete fix for CVE-2024-7730, confirm that the new patch does not simply add a length check without addressing root causes in buffer allocation or frame handling. Consult the QEMU security advisory for technical details and any related CVEs patched in the same release.

Detection guidance

At runtime, monitor for segmentation faults, illegal memory access exceptions, or unexpected crashes in QEMU processes, especially when audio input is active. Kernel-level tools (e.g., AddressSanitizer if QEMU is built with ASAN, or ftrace/perf) can detect out-of-bounds heap writes during testing. Check guest audit logs for privilege escalation attempts following audio-related system calls. Network-based detection is not applicable (local-only attack). Forensic examination of heap dumps after a crash may reveal corruption patterns consistent with this vulnerability. Proactive scanning should focus on inventorying systems with audio devices enabled and prioritizing their patching.

Why prioritize this

This vulnerability rates HIGH (CVSS 7.4) and should be addressed with urgency for audio-enabled systems. Although local-only access is required, the impact spans confidentiality, integrity, and availability. Guest-to-host escape potential and the incomplete nature of the prior fix increase concern. Prioritize systems in untrusted environments (dev/test with external users), multi-tenant cloud platforms, and those running high-privilege guest workloads. Systems with audio disabled can be deprioritized, but inventorying and patching should still be scheduled within 30 days.

Risk score, explained

The CVSS 7.4 HIGH score reflects: (1) local attack vector, reducing immediate likelihood but not impact; (2) heap out-of-bounds write enabling both privilege escalation and denial of service; (3) no user interaction required once audio is captured; (4) high confidentiality, integrity, and availability impact. The vector AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H indicates a local attacker without privileges can reliably corrupt memory when conditions align (audio processing). The incomplete prior fix elevates risk by suggesting similar flaws may exist or recur.

Frequently asked questions