CVE-2025-14876
Medium · 5.5CVSS
5.5
EPSS
0.2%
Published
Feb 18, 2026
CISA due date
—
The record
A flaw was found in the virtio-crypto device of QEMU. A malicious guest operating system can exploit a missing length limit in the AKCIPHER path, leading to uncontrolled memory allocation. This can result in a denial of service (DoS) on the host system by causing the QEMU process to terminate unexpectedly.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | qemu | 0 | 9.2.4-150700.3.17.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP7 | qemu | 0 | 9.2.4-150700.3.17.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP7 | qemu-linux-user | 0 | 9.2.4-150700.3.17.1 |
| SUSE:Linux Enterprise Module for Server Applications 15 SP7 | qemu | 0 | 9.2.4-150700.3.17.1 |
| openSUSE:Leap 15.6 | qemu | 0 | 8.2.10-150600.3.46.1 |
| openSUSE:Leap 15.6 | qemu-linux-user | 0 | 8.2.10-150600.3.46.1 |
| openSUSE:Leap 16.0 | qemu | 0 | 10.0.8-160000.1.1 |
| openSUSE:Leap 16.0 | qemu-linux-user | 0 | 10.0.8-160000.1.1 |
| openSUSE:Tumbleweed | qemu | 0 | 10.2.1-1.1 |
Related vulnerabilities
- CVE-2026-0665 An off-by-one error was found in QEMU's KVM Xen guest support. Also affects qemu
- CVE-2025-12464 A stack-based buffer overflow was found in the QEMU e1000 network device. Also affects qemu
- CVE-2024-8612 A flaw was found in QEMU, in the virtio-scsi, virtio-blk, and virtio-crypto devices. Also affects qemu
- CVE-2024-8354 A flaw was found in QEMU. Also affects qemu
- CVE-2024-4693 A flaw was found in the QEMU Virtio PCI Bindings (hw/virtio/virtio-pci.c). Also affects qemu
- CVE-2026-3195 A flaw was found in QEMU. Also affects qemu
- CVE-2026-3196 An integer overflow vulnerability was found in the virtio-snd device via PCM_INFO… Also affects qemu
- CVE-2026-2243 A flaw was found in QEMU. Also affects qemu