CVE-2026-46655

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-46655
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-46655.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-46655
Aliases
  • GHSA-qrhp-4mhp-hjwh
Published
2026-09-18T16:46:34Z
Modified
2026-09-20T14:24:43Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
virtio-win: Integer overflow causing a heap overflow in Viosock driver
Details

virtio-win provides Windows paravirtualized drivers for QEMU and KVM. From mm210 until mm320, the Viosock driver permits a low-privilege local process to submit an IOCTL_SELECT request with attacker-controlled VIRTIO_VSOCK_SELECT.Fdss[*].fd_count values that overflow the 32-bit sum used by VIOSockSelect for bounds checking. The wrapped sum can pass the FD_SETSIZE check even though an individual descriptor count is much larger than the expected limit. VIOSockSelectCopyFds then iterates using the unchecked count and writes beyond the allocated pPkt->Fds array in the NonPagedPool kernel heap. Successful exploitation can corrupt kernel memory and enable privilege escalation in a Windows guest running the driver. This issue is fixed in mm320.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-122",
        "CWE-190"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46655.json"
}
References

Affected packages

Git / github.com/virtio-win/kvm-guest-drivers-windows

Affected ranges

Type
GIT
Repo
https://github.com/virtio-win/kvm-guest-drivers-windows
Events
Introduced
76eab1fcf2bd94182538e519900791ccb0d88810
Fixed
c6bef93d7909584bbda4e5c87603ea175825f342
Fixed
e295fa32fe9e3219b63e4055971b97dc9f7d84f5
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "mm210"
        },
        {
            "fixed": "mm320"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

01.*
01.11.2023-last-buildable-point-Win8
02.*
02.12.2021-last-buildable-point-Win7
08.*
08.03.2021-last-buldable-point-XP
Other
mm210
mm216
mm224
mm228
mm235
mm237
mm241
mm245
mm249
mm260
mm268
mm282
mm286
mm312
mm313
mm314
mm315
mm316
mm317
mm318
mm319

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-46655.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "257269614564495422387372943986302016076",
                "56121719056322984262217181978164689248",
                "95213728126496253239617302969967051612",
                "781054844622847279745456316596124238",
                "248155876438362162941235533562420237854",
                "113627483962707409465590661187875545649",
                "316353147794372185831554733553772452510",
                "185818641677448765431671204115498372242",
                "17653417256783036034800459754685681412"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-46655-29168439",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/virtio-win/kvm-guest-drivers-windows/commit/c6bef93d7909584bbda4e5c87603ea175825f342",
        "target": {
            "file": "viosock/sys/Device.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "185707896953127633483900136339374502993",
            "length": 2456
        },
        "id": "CVE-2026-46655-6f733ffe",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/virtio-win/kvm-guest-drivers-windows/commit/c6bef93d7909584bbda4e5c87603ea175825f342",
        "target": {
            "file": "viosock/sys/Device.c",
            "function": "VIOSockSelect"
        }
    }
]
vanir_signatures_modified 
"2026-09-20T14:24:43Z"