A heap-based buffer overflow vulnerability (CWE-122) exists in QEMU's virtio-snd device input callback function, virtio_snd_pcm_in_cb, due to lack of proper bounds checking on the input audio data buffer (iov). This flaw can lead to heap out-of-bounds writes, potentially allowing an attacker with local access inside a guest VM to crash QEMU or execute arbitrary code on the host. The vulnerability is linked to an incomplete fix for CVE-2024-7730. It affects various Ubuntu QEMU package versions, specifically in Ubuntu 24.04 LTS and 25.10 releases. Red Hat Enterprise Linux's QEMU packages are not affected because the virtio-snd device is disabled at build time, removing the attack surface. The CVSS v3.1 score is 7.4 (High), with attack vector local, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Official Ubuntu advisories provide patched package versions and recommend restarting all QEMU virtual machines after updating.

An attacker with local access inside a guest virtual machine could exploit this vulnerability to cause QEMU to crash (denial of service) or potentially execute arbitrary code on the host system. The vulnerability impacts confidentiality, integrity, and availability of the host running QEMU. The CVSS score of 7.4 reflects a high severity with significant potential impact. Red Hat's QEMU packages are not affected due to the virtio-snd device being disabled at build time, effectively mitigating the risk in those environments.

Apply the official patches provided by Ubuntu by updating to the fixed package versions listed in the Ubuntu security advisory USN-8161-1. After updating, restart all QEMU virtual machines to ensure the fixes take effect. For Red Hat Enterprise Linux users, no action is required as the virtio-snd device is disabled at build time, removing the attack surface for this vulnerability.