CVE-2026-48914: QEMU virtio-blk Heap Overflow Denial of Service Vulnerability

Technical summary

The vulnerability exists in QEMU's virtio-blk device implementation, which handles block device I/O requests between guest and host. The device accepts descriptor information from guest-submitted virtio requests without properly validating descriptor sizes before using them in heap write operations. When a privileged guest process submits a malformed SCSI command via the virtio-blk interface with an oversized or malicious descriptor, the host QEMU process writes beyond allocated heap buffer boundaries. This heap overflow can corrupt adjacent memory structures, leading to process termination. The issue is categorized as CWE-122 (Heap-based Buffer Overflow), a classic memory safety flaw that arises from inadequate input validation at the hypervisor-guest boundary.

Business impact

Organizations deploying QEMU-based virtualization environments face a denial-of-service risk where a single compromised or malicious guest can crash the host hypervisor process, affecting all virtual machines on that host. This translates to unplanned downtime for workloads sharing the same hypervisor. While the vulnerability requires the attacker to possess administrative privileges within a guest—limiting the blast radius compared to remote exploits—the impact is significant in multi-tenant or shared-resource scenarios. In cloud environments or data centers running untrusted or third-party workloads, this becomes a critical isolation concern. Availability disruptions can cascade across dependent services, making timely remediation important for business continuity.

Affected systems

This vulnerability affects QEMU's virtio-blk device implementation. All versions that lack proper input descriptor validation are susceptible. The scope spans deployments of QEMU used as a hypervisor or emulator across Linux, Windows, macOS, and other platforms where QEMU is installed. Environments particularly affected include KVM-based clouds, OpenStack instances using QEMU/KVM, and any infrastructure relying on QEMU for virtualization. Virtual machines using virtio-blk devices for storage (a common and performant configuration) present an attack surface if the guest operating system is untrusted or has been compromised. Verify against the QEMU project's official advisories and release notes for the precise list of affected versions and patched releases.

Exploitability

Exploiting this vulnerability requires the attacker to execute code with administrative or root privileges within a guest virtual machine. This is not a remote unauthenticated vulnerability; it assumes an already-compromised or malicious guest environment. Once inside a privileged guest context, the attacker can craft a malformed virtio-blk SCSI request that bypasses descriptor validation. The exploit is locally triggered and does not require user interaction. From a practical standpoint, the barrier to exploitation is lower in environments where guests run untrusted or user-supplied workloads, but higher in environments where all guests are tightly controlled and monitored. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting limited public weaponization at the time of publication.

Remediation

Apply security patches released by the QEMU project. Patched versions will include input validation logic that ensures descriptor sizes conform to expected bounds before heap operations are performed. Consult the QEMU security advisories and release notes to identify the minimum patched version for your deployment. In the interim, consider restricting guest administrative privileges where feasible, isolating untrusted workloads to dedicated hypervisors, and monitoring QEMU process behavior for unexpected crashes. Ensure hypervisors running untrusted guest workloads are regularly audited for this and related issues.

Patch guidance

Check the QEMU project's official security announcements and the latest stable release notes for information on patched versions. Patch availability typically follows coordinated disclosure timelines. Organizations should subscribe to QEMU security mailing lists and monitor release channels for guidance. Testing patches in a non-production environment is recommended before deployment, particularly in multi-tenant scenarios where guest isolation is critical. Verify that your specific QEMU version and configuration are covered by the patch before rolling out to production hypervisors.

Detection guidance

Monitor QEMU process termination and restart events, particularly unexpected crashes of qemu-system-* processes on production hypervisors. Log aggregation systems should flag abnormal QEMU exits coinciding with guest activity. Intrusion detection systems may detect suspicious virtio-blk SCSI command patterns if instrumented with hypervisor-level visibility, though detecting this at the hypervisor boundary is challenging. Endpoint Detection and Response (EDR) tools on host systems can alert on unexpected QEMU crashes. Additionally, audit guest administrative activity and SCSI command submissions for anomalies. Maintain detailed logs of guest-to-host interactions for forensic analysis after an incident.

Why prioritize this

This vulnerability merits prompt remediation because it enables a single compromised guest to disrupt an entire hypervisor and all co-hosted virtual machines, creating a denial-of-service vector in shared infrastructure. While the attack vector requires administrative guest privileges (limiting its scope compared to remote exploits), the impact—loss of availability across all hosted workloads—is substantial. The CVSS score of 6.7 (Medium) reflects the high availability impact (A:H) balanced against the requirement for high privilege (PR:H) and local attack surface (AV:L). Organizations operating multi-tenant QEMU environments or hosting untrusted workloads should prioritize this patch. Stable single-tenant deployments face lower immediate risk but should still apply patches during normal maintenance cycles.

Risk score, explained

The CVSS v3.1 score of 6.7 places this vulnerability in the Medium severity tier. The vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:H breaks down as follows: Attack Vector (AV:L) indicates local access—the attacker must run code on the host or within a guest. Attack Complexity (AC:L) is low, meaning no special conditions are required beyond the privilege level. Privileges Required (PR:H) is high, reflecting the requirement for administrative access within the guest. User Interaction (UI:N) is none. Scope (S:C) is changed, indicating the impact extends beyond the vulnerable component to the host system and other guests. Confidentiality (C:N) is unaffected—no data disclosure. Integrity (I:L) is low—memory corruption can alter host state but is not the primary goal. Availability (A:H) is high—the DoS impact is severe. The score balances substantial availability impact against the requirement for high guest privileges, resulting in a Medium rating that should not be dismissed in shared infrastructure environments.

Frequently asked questions