OESA-2026-2861

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-2861
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2026-2861.json
JSON Data
https://api.osv.dev/v1/vulns/OESA-2026-2861
Upstream
  • CVE-2026-3886
Published
2026-07-06T06:28:55Z
Modified
2026-07-06T06:45:12.582090911Z
Summary
qemu security update
Details

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.

Security Fix(es):

A vulnerability, which was classified as critical, has been found in QEMU (Virtualization Software) (version unknown).Using CWE to declare the problem leads to CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control.Impacted is confidentiality, integrity, and availability.Upgrading eliminates this vulnerability.(CVE-2026-3886)

A flaw was found in QEMU's virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors before writing data. A malicious guest with high privileges could exploit this vulnerability by submitting a malformed virtio-blk SCSI request, leading to an out-of-bounds write in the host heap memory and a potential denial of service (DoS) for the QEMU process.(CVE-2026-48914)

Database specific 
{
    "severity": "High"
}
References

Affected packages

openEuler:24.03-LTS-SP3 / qemu

Package

Name
qemu
Purl
pkg:rpm/openEuler/qemu&distro=openEuler-24.03-LTS-SP3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
8.2.0-80.oe2403sp3

Ecosystem specific 

{
    "aarch64": [
        "qemu-8.2.0-80.oe2403sp3.aarch64.rpm",
        "qemu-block-curl-8.2.0-80.oe2403sp3.aarch64.rpm",
        "qemu-block-iscsi-8.2.0-80.oe2403sp3.aarch64.rpm",
        "qemu-block-rbd-8.2.0-80.oe2403sp3.aarch64.rpm",
        "qemu-block-ssh-8.2.0-80.oe2403sp3.aarch64.rpm",
        "qemu-debuginfo-8.2.0-80.oe2403sp3.aarch64.rpm",
        "qemu-debugsource-8.2.0-80.oe2403sp3.aarch64.rpm",
        "qemu-guest-agent-8.2.0-80.oe2403sp3.aarch64.rpm",
        "qemu-hw-usb-host-8.2.0-80.oe2403sp3.aarch64.rpm",
        "qemu-img-8.2.0-80.oe2403sp3.aarch64.rpm",
        "qemu-system-aarch64-8.2.0-80.oe2403sp3.aarch64.rpm",
        "qemu-system-arm-8.2.0-80.oe2403sp3.aarch64.rpm",
        "qemu-system-riscv-8.2.0-80.oe2403sp3.aarch64.rpm",
        "qemu-system-x86_64-8.2.0-80.oe2403sp3.aarch64.rpm",
        "qemu-user-8.2.0-80.oe2403sp3.aarch64.rpm",
        "qemu-user-binfmt-8.2.0-80.oe2403sp3.aarch64.rpm",
        "qemu-user-static-8.2.0-80.oe2403sp3.aarch64.rpm"
    ],
    "noarch": [
        "qemu-help-8.2.0-80.oe2403sp3.noarch.rpm"
    ],
    "x86_64": [
        "qemu-8.2.0-80.oe2403sp3.x86_64.rpm",
        "qemu-block-curl-8.2.0-80.oe2403sp3.x86_64.rpm",
        "qemu-block-iscsi-8.2.0-80.oe2403sp3.x86_64.rpm",
        "qemu-block-rbd-8.2.0-80.oe2403sp3.x86_64.rpm",
        "qemu-block-ssh-8.2.0-80.oe2403sp3.x86_64.rpm",
        "qemu-debuginfo-8.2.0-80.oe2403sp3.x86_64.rpm",
        "qemu-debugsource-8.2.0-80.oe2403sp3.x86_64.rpm",
        "qemu-guest-agent-8.2.0-80.oe2403sp3.x86_64.rpm",
        "qemu-hw-usb-host-8.2.0-80.oe2403sp3.x86_64.rpm",
        "qemu-img-8.2.0-80.oe2403sp3.x86_64.rpm",
        "qemu-seabios-8.2.0-80.oe2403sp3.x86_64.rpm",
        "qemu-system-aarch64-8.2.0-80.oe2403sp3.x86_64.rpm",
        "qemu-system-arm-8.2.0-80.oe2403sp3.x86_64.rpm",
        "qemu-system-riscv-8.2.0-80.oe2403sp3.x86_64.rpm",
        "qemu-system-x86_64-8.2.0-80.oe2403sp3.x86_64.rpm",
        "qemu-user-8.2.0-80.oe2403sp3.x86_64.rpm",
        "qemu-user-binfmt-8.2.0-80.oe2403sp3.x86_64.rpm",
        "qemu-user-static-8.2.0-80.oe2403sp3.x86_64.rpm"
    ],
    "src": [
        "qemu-8.2.0-80.oe2403sp3.src.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-2861.json"