CVE-2026-48914

Name of the Vulnerable Software and Affected Versions QEMU (affected versions not specified)

Description A flaw exists in the virtio-blk device where the system fails to properly validate the size of input descriptors before writing data. A malicious guest with high privileges can exploit this by submitting a malformed virtio-blk SCSI request, resulting in an out-of-bounds write in the host heap memory. This can lead to a denial of service (DoS) for the QEMU process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.