hw/display/cirrusvgarop.h in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) via vectors related to copying VGA data via the cirrusbitbltropfwdtransp_ and cirrusbitbltropfwd functions.