CVE-2025-12464: Qemu-kvm: stack buffer overflow in e1000 device via short frames in loopback mode
A stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and moved to the net core code. The issue stems from the device's receive code still being able to process a short frame in loopback mode. This could lead to a buffer overrun in the e1000_receive_iov() function via the loopback code path. A malicious guest user could use this vulnerability to crash the QEMU process on the host, resulting in a denial of service.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12464?
CVE-2025-12464 has a high severity due to the potential for stack-based buffer overflow vulnerabilities.
How do I fix CVE-2025-12464?
To mitigate CVE-2025-12464, update to the latest version of QEMU that includes a patch for this buffer overflow vulnerability.
What are the potential impacts of CVE-2025-12464?
CVE-2025-12464 could result in arbitrary code execution or denial of service if exploited.
Which versions of QEMU are affected by CVE-2025-12464?
CVE-2025-12464 affects specific versions of QEMU prior to the release of the patched update.
How can I determine if my system is vulnerable to CVE-2025-12464?
You can check your installed QEMU version against the advisories for CVE-2025-12464 to determine if your system is vulnerable.