CVE-2026-3842: Qemu-kvm: hyperv/syndbg: missing mapped-length guard after cpu_physical_memory_map causes host oob write
A flaw was found in QEMU. This vulnerability allows a local attacker within a guest virtual machine to write data beyond its allocated memory. This occurs when cpuphysicalmemorymap() returns a shorter length than expected, leading to an out-of-bounds write. Successful exploitation could result in unauthorized access to guest memory or corruption of heap-allocated objects, potentially causing information disclosure, data integrity issues, or a denial of service.
Other sources
If cpuphysicalmemorymap() returns a length shorter than the one that was passed into the function, writing the full outlen bytes causes an access beyond the memory allocated to the guest; or in the case of the MMIO bounce buffer, an out-of-bounds access in a heap-allocated object.
Upstream fix: https://gitlab.com/qemu-project/qemu/-/commit/4f28b87fdd24df2049626106b7c24d0180952115
— Red Hat
Qemu-kvm: hyperv/syndbg: missing mapped-length guard after cpuphysicalmemorymap causes host oob write
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.1.0-11 - Compensating control
Apply the upstream QEMU fix referenced by commit 4f28b87fdd24df2049626106b7c24d0180952115 to ensure hyperv/syndbg uses a mapped-length guard after cpu_physical_memory_map() so out_len is not written when the returned length is shorter than expected.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3842?
CVE-2026-3842 has a severity rating of high with a CVSS score of 7.8.
How do I fix CVE-2026-3842?
To fix CVE-2026-3842, update QEMU to the latest version that addresses this vulnerability.
Who is impacted by CVE-2026-3842?
CVE-2026-3842 impacts local users within guest virtual machines running vulnerable versions of QEMU.
What can happen if CVE-2026-3842 is exploited?
Exploiting CVE-2026-3842 can lead to out-of-bounds writes, potentially allowing attackers to overwrite memory and escalate privileges.
When was CVE-2026-3842 published?
CVE-2026-3842 was published on April 14, 2026.