CVE-2026-3195 is a heap-based buffer overflow vulnerability in QEMU's virtio-snd device input callback function `virtio_snd_pcm_in_cb`. The flaw arises because the function fails to check whether the input iov structure can fit the incoming data buffer, which may result in a heap out-of-bounds write. This vulnerability is a consequence of an incomplete remediation of a previous vulnerability (CVE-2024-7730). The vulnerability has a CVSS 3.1 base score of 7.4, indicating high severity, with impacts on confidentiality, integrity, and availability. No official patch or remediation level is currently provided by the vendor advisory, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability could lead to arbitrary code execution or denial of service due to heap corruption. The CVSS score of 7.4 reflects high impact on confidentiality, integrity, and availability. However, there are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-3195 for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates. No specific temporary mitigations are documented in the advisory.