CVSS 3.0
9.9 criticalCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HCVE-2017-2620
Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process.
Severity
- EPSS
- 3.6% chance of exploitation in the next 30 days; higher than 89% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-125, CWE-787
- Published
- Modified
- Record from
- the NVD, synced
Affected
- citrix:xenserver
- debian:debian_linux
- qemu:qemu
- redhat:enterprise_linux_desktop
- redhat:enterprise_linux_server
- redhat:enterprise_linux_server_aus
- redhat:enterprise_linux_server_eus
- redhat:enterprise_linux_workstation
- redhat:openstack
- xen:xen