This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-3842 →
Categories
DEBIAN-CVE-2026-3842

A flaw was found in QEMU. This vulnerability allows a local attacker within a guest virtual machine to write data beyond its allocated memory. This oc...

Original description

The description as published by the source.

A flaw was found in QEMU. This vulnerability allows a local attacker within a guest virtual machine to write data beyond its allocated memory. This occurs when cpu_physical_memory_map() returns a shorter length than expected, leading to an out-of-bounds write. Successful exploitation could result in unauthorized access to guest memory or corruption of heap-allocated objects, potentially causing information disclosure, data integrity issues, or a denial of service.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 qemu
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:13 qemu
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.0.10+ds-0+deb13u1"}]}]
Debian:14 qemu
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.2.2+ds-1"}]}]

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details