Medium severity6.0NVD Advisory· Published Dec 10, 2016· Updated May 6, 2026

CVE-2016-7995

Description

Memory leak in the ehci_process_itd function in hw/usb/hcd-ehci.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) via a large number of crafted buffer page select (PG) indexes.

Affected products

QEMU/Qemu
cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*
Range: <=2.7.1
OpenSUSE/Leap
cpe:2.3:o:opensuse:leap:42.2:*:*:*:*:*:*:*

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

lists.gnu.org/archive/html/qemu-devel/2016-09/msg06609.htmlnvdPatchThird Party Advisory
lists.opensuse.org/opensuse-updates/2016-12/msg00140.htmlnvdMailing ListThird Party Advisory
www.openwall.com/lists/oss-security/2016/10/07/3nvdMailing ListThird Party Advisory
www.openwall.com/lists/oss-security/2016/10/08/4nvdMailing ListThird Party Advisory
www.securityfocus.com/bid/93454nvdThird Party AdvisoryVDB Entry

News mentions

No linked articles in our index yet.

cvss	0.390
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000