This update for qemu fixes six vulnerabilities: CVE-2025-14876 involves unbounded allocation in virtio-crypto; CVE-2026-0665 is an out-of-bounds heap access causing denial of service or memory corruption; CVE-2026-2243 is an incorrect bounds check leading to a heap out-of-bounds read and a 12-byte information leak when processing specially crafted VMDK files; CVE-2026-3195 is a heap buffer overflow in the virtio-snd device input callback due to insufficient checks; CVE-2026-3196 is an integer overflow in virtio-snd via PCM_INFO requests causing unbounded memory allocation and host denial-of-service; CVE-2026-3842 is a missing mapped-length guard in hyperv/syndbg causing host out-of-bounds write. These vulnerabilities collectively impact memory safety and can lead to denial of service, information leaks, and potential host corruption.

The vulnerabilities can cause denial of service conditions, potential memory corruption, information disclosure of 12 bytes from heap memory, and out-of-bounds writes on the host system. These impacts affect the stability and security of the host running qemu, potentially allowing attackers to disrupt service or gain limited information.

A security update for qemu has been released by the SUSE Product Security Team addressing these vulnerabilities. Users should apply the official update SUSE-SU-2026:2386-1 to remediate these issues. No additional mitigation steps are indicated beyond applying this update.