PatchTheCVEqemu vulnerabilities and fixes
Recent CVEs affecting qemu, with upgrade or downgrade steps. 7 tracked.
qemu has 7 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 4. Most recent: 2025-07-25. Highest priority: CVE-2024-6505 (score 42/100).
- CVE-2025-54567 MEDIUM 4.2 UPGRADE hw/pci/pcie_sriov.c in QEMU through 10.0.3 mishandles the VF Enable bit write mask, a related issue to CVE-202
- CVE-2025-54566 MEDIUM 4.2 UPGRADE hw/pci/pcie_sriov.c in QEMU through 10.0.3 has a migration state inconsistency, a related issue to CVE-2024-26
- CVE-2024-8354 MEDIUM 5.5 MITIGATE MITIGATE A flaw was found in QEMU
- CVE-2024-7730 HIGH 7.4 UPGRADE A heap buffer overflow was found in the virtio-snd device in QEMU
- CVE-2024-6519 HIGH 8.2 MITIGATE A use-after-free vulnerability was found in the QEMU LSI53C895A SCSI Host Bus Adapter emulation
- CVE-2024-6505 MEDIUM 6.8 MITIGATE MITIGATE A flaw was found in the virtio-net device in QEMU
- CVE-2024-3447 MEDIUM 6.0 UPGRADE MITIGATE A heap-based buffer overflow was found in the SDHCI device emulation of QEMU
FAQ
How do I fix qemu vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is qemu being exploited right now?
None of the tracked qemu CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which qemu CVE should I patch first?
CVE-2024-6505 currently ranks highest (42/100): A flaw was found in the virtio-net device in QEMU.