CVE-2026-81627

HighCVSS 8.2/10Last modified Sep 21, 2026

Description

A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A privileged guest user on a Q35/KVM machine can position this alias over locked SMRAM, bypassing chipset D_LCK protection and injecting code into System Management Mode memory.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 18, 2026
Last modified: Sep 21, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-81638.8The Infility Global WordPress plugin before 2.15.19 does not properly sanitize and escape some parameters before using them in SQL statement CVE-2026-816308.1The Botslab G980H dash camera firmware does not adequately verify the authenticity of firmware updates. The update process retrieves firmwar CVE-2026-816327.2Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access lo CVE-2026-816336.9Improper Input Validation vulnerability in ash-project ash_graphql allows an unauthenticated client to crash a relay node(id: ...) query wit CVE-2026-816347.5In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow durin CVE-2026-816355.1A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an attacker to execute an arbitrary script in the web browser of a CVE-2026-816368.7Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_graphql allows an unauthenticated client to bypass the CVE-2026-816372.3Insufficient Session Expiration vulnerability in team-alembic AshAuthentication allows an attacker who obtains a victim's OAuth2 state value CVE-2026-816382.1Improper Handling of Alternate Encoding vulnerability in ash-project ash_double_entry allows an attacker to submit several distinct string s CVE-2026-81647.3Uncontrolled Search Path Element vulnerability in ArkSigner Software and Hardware Industry and Trade Inc. ArkSigner Desktop Client allows Se CVE-2026-816408.8An attacker could derive the camera's Wi-Fi password and connect to its wireless network. This weakens or eliminates the security value of t CVE-2026-816429.8In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possi