OESA-2026-3843

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.

Security Fix(es):

An unknown vulnerability exists in QEMU, with no detailed description available at this time.(CVE-2026-15264)

CVE-2026-18054 is a vulnerability in QEMU, details are not yet disclosed.(CVE-2026-18054)

This update to qemu-10.2.4-2.mga10 fixes 14 CVEs from 10.2.3 and 2 from 10.2.4(CVE-2026-3890)

This update to qemu-10.2.4-2.mga10 fixes 14 CVEs from 10.2.3 and 2 from 10.2.4. This vulnerability (CVE-2026-48004) is one of them.(CVE-2026-48004)

QEMU's virtio-rng frontend does not cancel or detach an RngRequest that is still pending on the rng-random backend before releasing the VirtIORNG object in virtio_rng_device_unrealize(). When a virtio-rng device is hot-plugged (device_del) and there are still entropy requests pending, the delayed backend completion calls the chr_read callback on the released object, causing the host heap to be use-after-free. An attacker able to trigger hot-plugging of the device could exploit this memory security flaw to compromise the QEMU process, causing a denial of service or potential code execution on the host.(CVE-2026-50624)

An unspecified vulnerability exists in QEMU, with no detailed information available at this time.(CVE-2026-61476)

CVE-2026-63109 is a vulnerability in QEMU. Details of this vulnerability have not been publicly disclosed yet.(CVE-2026-63109)

No detailed description available.(CVE-2026-63110)

An unknown vulnerability exists in QEMU, the details of which have not yet been disclosed. Attackers may exploit this vulnerability to cause unknown impacts.(CVE-2026-63320)

An unknown vulnerability exists in QEMU, the details of which have not yet been disclosed. Attackers may exploit this vulnerability to cause unknown impacts.(CVE-2026-63321)

When QEMU's uefi-vars-x64 virtual device processes the VarCheckPolicy REGISTER command, the uefi_vars_mm_check_policy_register() function directly reads pe->size without first verifying whether the request length contains the complete variable_policy_entry header. The guest can send a REGISTER request with a length of exactly sizeof(mm_check_policy) (excluding variable_policy_entry), causing the func pointer to cross the end of the allocated MM communication buffer, causing the host heap buffer to read out of bounds (heap-buffer-overflow). An attacker could exploit this memory security flaw to compromise the QEMU process, causing a denial of service or potential code execution on the host.(CVE-2026-63322)

An undisclosed vulnerability exists in QEMU, the details of which are not yet publicly available.(CVE-2026-63323)

An unknown type vulnerability exists in QEMU (Quick Emulator). The specific details have not been disclosed yet.(CVE-2026-65928)

CVE-2026-65929 is a security vulnerability affecting QEMU, with no detailed technical information disclosed yet.(CVE-2026-65929)

An unspecified vulnerability exists in QEMU, the details of which have not been disclosed.(CVE-2026-66022)

QEMU's VNC extended clipboard handler, after decompressing a client-controlled clipboard payload, compares the declared text size to the entire decompression buffer size, but then copies tsize bytes from buf + 4. The correct boundary is the remaining data length after the 4-byte length field. Therefore, a VNC client can cause QEMU to read up to 3 bytes out of bounds from the end of the decompressed heap buffer; a second VNC client can observe these bytes through the normal VNC extended clipboard PROVIDE path.(CVE-2026-8343)