ZDI-26-332: QEMU calc_image_hostmem Integer Overflow Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of QEMU. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-3886.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-26-332?
ZDI-26-332 has a CVSS rating of 8.8, indicating a high severity level.
How do I fix ZDI-26-332?
To fix ZDI-26-332, update to the latest version of QEMU that addresses this vulnerability.
What type of vulnerability is ZDI-26-332?
ZDI-26-332 is an integer overflow local privilege escalation vulnerability in QEMU.
Who can exploit ZDI-26-332?
Local attackers who have the ability to execute low-privileged code on the target guest system can exploit ZDI-26-332.
What software versions are affected by ZDI-26-332?
ZDI-26-332 affects certain installations of QEMU, specifically those versions prior to the security update.