CVE-2026-2243
Medium · 5.1CVSS
5.1
EPSS
0.1%
Published
Feb 19, 2026
CISA due date
—
The record
A flaw was found in QEMU. A specially crafted VMDK image could trigger an out-of-bounds read vulnerability, potentially leading to a 12-byte leak of sensitive information or a denial of service condition (DoS).
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | qemu | 0 | 10.0.9-160000.1.1 |
| openSUSE:Leap 16.0 | qemu-linux-user | 0 | 10.0.9-160000.1.1 |
| openSUSE:Tumbleweed | qemu | 0 | 10.2.2-1.1 |
Related vulnerabilities
- CVE-2026-3195 A flaw was found in QEMU. Also affects qemu
- CVE-2026-3196 An integer overflow vulnerability was found in the virtio-snd device via PCM_INFO… Also affects qemu
- CVE-2026-0665 An off-by-one error was found in QEMU's KVM Xen guest support. Also affects qemu
- CVE-2025-14876 A flaw was found in the virtio-crypto device of QEMU. Also affects qemu
- CVE-2025-12464 A stack-based buffer overflow was found in the QEMU e1000 network device. Also affects qemu
- CVE-2024-3447 A heap-based buffer overflow was found in the SDHCI device emulation of QEMU. Also affects qemu
- CVE-2024-8612 A flaw was found in QEMU, in the virtio-scsi, virtio-blk, and virtio-crypto devices. Also affects qemu
- CVE-2024-26328 An issue was discovered in QEMU 7.1.0 through 8.2.1. Also affects qemu