CVE-2026-48914 is a heap-based buffer overflow vulnerability in the virtio-blk device component of QEMU. The flaw arises because the device does not properly validate the size of input descriptors before writing data, allowing a malicious guest with high privileges to submit a malformed virtio-blk SCSI request. This can lead to an out-of-bounds write in the host's heap memory, potentially causing a denial of service (DoS) condition for the QEMU process. The vulnerability has a CVSS 3.1 base score of 6.7, reflecting a medium severity with local attack vector, low attack complexity, high privileges required, no user interaction, and impact limited to integrity and availability. Red Hat has published a security advisory and issued updates for Red Hat Enterprise Linux 9 addressing this vulnerability. However, the input data does not confirm patch availability or remediation status for Red Hat Enterprise Linux 10 version 1.1.0.

Exploitation of this vulnerability allows a privileged malicious guest to cause an out-of-bounds write in the host heap memory, which can lead to denial of service (DoS) of the QEMU process. There is no indication of confidentiality impact. The vulnerability requires high privileges on the guest and local access. No known exploits in the wild have been reported.

Red Hat has released security updates addressing this vulnerability for Red Hat Enterprise Linux 9, as documented in their advisory RHSA-2026:39311. Users of affected versions should apply the available updates as per Red Hat's guidance at https://access.redhat.com/articles/11258. For Red Hat Enterprise Linux 10 version 1.1.0, patch status is not explicitly confirmed in the provided data; users should consult the official Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-48914 for current remediation guidance.