PatchTheCVEqemu vulnerabilities
Recent CVEs affecting qemu products. 6 tracked.
qemu has 6 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 4. Most recent: 2025-07-25. Highest priority: CVE-2024-3447 (score 38/100).
- CVE-2025-54567 MEDIUM 4.2 UPGRADE hw/pci/pcie_sriov.c in QEMU through 10.0.3 mishandles the VF Enable bit write mask, a related issue to CVE-202
- CVE-2025-54566 MEDIUM 4.2 UPGRADE hw/pci/pcie_sriov.c in QEMU through 10.0.3 has a migration state inconsistency, a related issue to CVE-2024-26
- CVE-2024-8354 MEDIUM 5.5 MITIGATE MITIGATE A flaw was found in QEMU
- CVE-2024-7730 HIGH 7.4 UPGRADE A heap buffer overflow was found in the virtio-snd device in QEMU
- CVE-2024-6519 HIGH 8.2 MITIGATE A use-after-free vulnerability was found in the QEMU LSI53C895A SCSI Host Bus Adapter emulation
- CVE-2024-3447 MEDIUM 6.0 UPGRADE MITIGATE A heap-based buffer overflow was found in the SDHCI device emulation of QEMU
FAQ
How do I fix qemu vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is qemu being exploited right now?
None of the tracked qemu CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which qemu CVE should I patch first?
CVE-2024-3447 currently ranks highest (38/100): A heap-based buffer overflow was found in the SDHCI device emulation of QEMU.