CVE-2017-2630

8.8 highEPSS 2.6%

A stack buffer overflow flaw was found in the Quick Emulator (QEMU) before 2.9 built with the Network Block Device (NBD) client support. The flaw could occur while processing server's response to a 'NBD_OPT_LIST' request. A malicious NBD server could use this issue to crash a remote NBD client resulting in DoS or potentially execute arbitrary code on client host with privileges of the QEMU process.

Severity

CVSS 3.0

8.8 high

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 2.6% chance of exploitation in the next 30 days; higher than 85% of CVEs (scores of 2026-10-31)
CWEs: CWE-121, CWE-119
Published: 2018-07-27
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

qemu:qemu

References

http://www.openwall.com/lists/oss-security/2017/02/15/2
http://www.securityfocus.com/bid/96265
https://access.redhat.com/errata/RHSA-2017:2392
https://bugzilla.redhat.com/show_bug.cgi?id=1422415
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2630

Check your stack JSON