Cloudanix VulnDB

CVE-2025-12464

Medium · 6.2

CVSS

6.2

EPSS

0.2%

Published

Oct 31, 2025

CISA due date

—

The record

A stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and moved to the net core code. The issue stems from the device's receive code still being able to process a short frame in loopback mode. This could lead to a buffer overrun in the e1000_receive_iov() function via the loopback code path. A malicious guest user could use this vulnerability to crash the QEMU process on the host, resulting in a denial of service.

Affected packages

Ecosystem Package Introduced Fixed
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS qemu 0 6.2.0-150400.37.46.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS qemu 0 6.2.0-150400.37.46.1
SUSE:Linux Enterprise Micro 5.3 qemu 0 6.2.0-150400.37.46.1
SUSE:Linux Enterprise Micro 5.4 qemu 0 6.2.0-150400.37.46.1
SUSE:Linux Enterprise Server 15 SP4-LTSS qemu 0 6.2.0-150400.37.46.1
SUSE:Linux Enterprise Server 15 SP6-LTSS qemu 0 8.2.10-150600.3.43.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP4 qemu 0 6.2.0-150400.37.46.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP6 qemu 0 8.2.10-150600.3.43.1
SUSE:Manager Proxy LTS 4.3 qemu 0 6.2.0-150400.37.46.1
SUSE:Manager Server LTS 4.3 qemu 0 6.2.0-150400.37.46.1
openSUSE:Leap 15.6 qemu 0 8.2.10-150600.3.43.1
openSUSE:Leap 15.6 qemu-linux-user 0 8.2.10-150600.3.43.1
openSUSE:Leap 16.0 qemu 0 10.0.7-160000.1.1
openSUSE:Leap 16.0 qemu-linux-user 0 10.0.7-160000.1.1
openSUSE:Tumbleweed qemu 0 10.1.3-1.1

Related vulnerabilities