Medium severity6.7NVD Advisory· Published Jun 12, 2026· Updated Aug 31, 2026
CVE-2026-48914
CVE-2026-48914
Description
A flaw was found in QEMU's virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors before writing data. A malicious guest with high privileges could exploit this vulnerability by submitting a malformed virtio-blk SCSI request, leading to an out-of-bounds write in the host heap memory and a potential denial of service (DoS) for the QEMU process.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
25- osv-coords23 versionspkg:rpm/almalinux/qemu-guest-agentpkg:rpm/almalinux/qemu-imgpkg:rpm/almalinux/qemu-kvmpkg:rpm/almalinux/qemu-kvm-audio-papkg:rpm/almalinux/qemu-kvm-block-blkiopkg:rpm/almalinux/qemu-kvm-block-curlpkg:rpm/almalinux/qemu-kvm-block-rbdpkg:rpm/almalinux/qemu-kvm-commonpkg:rpm/almalinux/qemu-kvm-corepkg:rpm/almalinux/qemu-kvm-device-display-virtio-gpupkg:rpm/almalinux/qemu-kvm-device-display-virtio-gpu-ccwpkg:rpm/almalinux/qemu-kvm-device-display-virtio-gpu-pcipkg:rpm/almalinux/qemu-kvm-device-display-virtio-vgapkg:rpm/almalinux/qemu-kvm-device-usb-hostpkg:rpm/almalinux/qemu-kvm-device-usb-redirectpkg:rpm/almalinux/qemu-kvm-docspkg:rpm/almalinux/qemu-kvm-toolspkg:rpm/almalinux/qemu-kvm-ui-egl-headlesspkg:rpm/almalinux/qemu-kvm-ui-openglpkg:rpm/almalinux/qemu-pr-helperpkg:rpm/opensuse/qemu&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/qemu&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/qemu-linux-user&distro=openSUSE%20Leap%2016.0
< 17:10.1.0-17.el9_8.4.alma.1+ 22 more
- (no CPE)range: < 17:10.1.0-17.el9_8.4.alma.1
- (no CPE)range: < 17:10.1.0-17.el9_8.4.alma.1
- (no CPE)range: < 17:10.1.0-17.el9_8.4.alma.1
- (no CPE)range: < 17:10.1.0-17.el9_8.4.alma.1
- (no CPE)range: < 17:10.1.0-17.el9_8.4.alma.1
- (no CPE)range: < 17:10.1.0-17.el9_8.4.alma.1
- (no CPE)range: < 17:10.1.0-17.el9_8.4.alma.1
- (no CPE)range: < 17:10.1.0-17.el9_8.4.alma.1
- (no CPE)range: < 17:10.1.0-17.el9_8.4.alma.1
- (no CPE)range: < 17:10.1.0-17.el9_8.4.alma.1
- (no CPE)range: < 17:10.1.0-17.el9_8.4.alma.1
- (no CPE)range: < 17:10.1.0-17.el9_8.4.alma.1
- (no CPE)range: < 17:10.1.0-17.el9_8.4.alma.1
- (no CPE)range: < 17:10.1.0-17.el9_8.4.alma.1
- (no CPE)range: < 17:10.1.0-17.el9_8.4.alma.1
- (no CPE)range: < 17:10.1.0-17.el9_8.4.alma.1
- (no CPE)range: < 17:10.1.0-17.el9_8.4.alma.1
- (no CPE)range: < 17:10.1.0-17.el9_8.4.alma.1
- (no CPE)range: < 17:10.1.0-17.el9_8.4.alma.1
- (no CPE)range: < 17:10.1.0-17.el9_8.4.alma.1
- (no CPE)range: < 10.0.11-160000.1.1
- (no CPE)range: < 11.0.2-1.1
- (no CPE)range: < 10.0.11-160000.1.1
Patches
Vulnerability mechanics
References
5News mentions
0No linked articles in our index yet.