This vulnerability in QEMU's virtio-blk device arises from improper validation of input descriptor sizes, allowing a malicious guest with high privileges to trigger an out-of-bounds write in the host heap memory. This can result in a denial of service affecting the QEMU process on Red Hat Enterprise Linux 10. The CVSS 3.1 base score is 6.7, indicating a medium severity with local attack vector, low attack complexity, high privileges required, no user interaction, scope changed, no confidentiality impact, low integrity impact, and high availability impact. No official patch or remediation level is stated in the vendor advisory, and no known exploits are reported in the wild as of the publication date.

Successful exploitation allows a privileged malicious guest to cause an out-of-bounds write in the host heap memory, potentially leading to denial of service of the QEMU process. There is no reported impact on confidentiality, but integrity impact is low and availability impact is high. The vulnerability requires local access with high privileges on the guest and does not involve user interaction.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-48914 for current remediation guidance. Until an official fix is available, restrict guest privileges to trusted users and monitor for unusual QEMU process behavior. No vendor advisory states that no action is required or that the issue is already mitigated.