This vulnerability in QEMU arises from insufficient bounds checking in the virtio_snd_pcm_in_cb function when processing input audio data for the virtio-snd device. Specifically, the function fails to confirm that the iov buffer is large enough to hold the incoming data, which can cause a heap out-of-bounds write. This issue is a result of an incomplete remediation of a previous vulnerability (CVE-2024-7730). The affected version explicitly identified is 8.2.0. No official remediation level or patch is currently stated in the vendor advisory, but Red Hat has published an advisory referencing this CVE.

Successful exploitation of this vulnerability could lead to a heap-based buffer overflow, potentially allowing an attacker with local access to cause a denial of service or execute arbitrary code with elevated privileges. The CVSS vector indicates that the attack requires local access with high attack complexity and no privileges or user interaction, but it impacts confidentiality, integrity, and availability at a high level.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-3195 for current remediation guidance. Since no explicit patch or remediation level is provided in the available data, users should monitor the vendor advisory for updates and apply any official fixes once available. Until then, restricting local access to trusted users and minimizing exposure of the virtio-snd device may reduce risk.