QEMU vulnerabilities and fixes

CVEs that mention QEMU, ranked by priority. 3 tracked.

QEMU has 3 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2026-08-12. Highest priority: CVE-2026-16033 (score 42/100).

• CVE-2026-16033 HIGH 8.5 UPGRADE A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained
• CVE-2026-13622 HIGH 8.8 A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy
• CVE-2026-12080 HIGH 7.3 A flaw was found in the QEMU Guest Agent (qga)

FAQ

How do I fix QEMU vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is QEMU being exploited right now?

None of the tracked QEMU CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which QEMU CVE should I patch first?

CVE-2026-16033 currently ranks highest (42/100): A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained .

← Back to latest CVEs