CVE-2026-48914

MediumCVSS 6.7/10Last modified Aug 31, 2026

Description

A flaw was found in QEMU's virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors before writing data. A malicious guest with high privileges could exploit this vulnerability by submitting a malformed virtio-blk SCSI request, leading to an out-of-bounds write in the host heap memory and a potential denial of service (DoS) for the QEMU process.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:H

Weakness enumeration

CWE-122

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Jun 12, 2026
Last modified: Aug 31, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-489166.6Jenkins LDAP Plugin 807.v7d7de30930cf and earlier follows LDAP referrals.CVE-2026-489176.6Jenkins LDAP Plugin 807.v7d7de30930cf and earlier deserializes data from LDAP referrals without validation.CVE-2026-489186.6Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals by default.CVE-2026-489196.6Jenkins Active Directory Plugin 2.41 and earlier deserializes data from LDAP referrals without validation.CVE-2026-48928.4A heap-based out-of-bounds write vulnerability in the DHCPv6 implementation of dnsmasq allows local attackers to execute arbitrary code with CVE-2026-489208.8Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as `base64` in email content by setting the `data-inlin CVE-2026-489217.5Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries, allowing a CVE-2026-489227.5Jenkins Credentials Binding Plugin 720.v3f6decef43ea_ and earlier does not properly sanitize file names for file and zip file credentials, a CVE-2026-489234.3Jenkins AppSpider Plugin 1.0.17 and earlier does not perform a permission check in a method implementing form validation, allowing attackers CVE-2026-489244.3Jenkins Bitbucket OAuth Plugin 0.17 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attac CVE-2026-489254.3A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Integration Plugin 0.7.3 and earlier allows attackers to attackers to tr CVE-2026-489264.3Jenkins Job Import Plugin 143.v044a_2e819b_27 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with O