Threats Tagged 'cve-2026-3195'

CVE-2026-3195 is a heap-based buffer overflow vulnerability in QEMU's virtio-snd device input callback function, virtio_snd_pcm_in_cb. The flaw arises from insufficient bounds checking on the input buffer, potentially leading to out-of-bounds writes. This vulnerability is a regression from an incomplete fix for CVE-2024-7730. It affects multiple Ubuntu package versions of QEMU and can allow an attacker inside a guest virtual machine to cause a denial of service or possibly execute arbitrary code on the host. A fix has been released by Ubuntu in updated QEMU package versions.

A flaw was found in QEMU. When reading input audio in the virtio-snd device input callback, the `virtio_snd_pcm_in_cb` function did not check whether the iov could fit the data buffer, potentially leading to a heap out-of-bounds write. This issue exists due to an incomplete fix for CVE-2024-7730.

This update for qemu fixes the following issues: - CVE-2025-14876: qemu-kvm: Unbounded allocation in virtio-crypto (bsc#1255400). - CVE-2026-0665: out-of-bounds heap access can lead to a denial of service or potential memory corruption (bsc#1256484). - CVE-2026-2243: incorrect bounds check leads to heap out-of-bounds read and a 12-byte information leak when processing specially crafted VMDK files (bsc#1258509). - CVE-2026-3195: heap buffer overflow when reading input audio in the virtio-snd device input callback due to insufficient checks in `virtio_snd_pcm_in_cb` (bsc#1259080). - CVE-2026-3196: integer overflow in the virtio-snd device via PCM_INFO requests from the guest leads to unbounded memory allocation and host denial-of-service (bsc#1259079). - CVE-2026-3842: hyperv/syndbg: missing mapped-length guard after cpu_physical_memory_map causes host OOB write (bsc#1262089).