Vigie VulnDBEuropean-hosted Vulnerability DB
FR
Menu

Qemu-kvm: vnc websocket handshake use-after-free (qemu)

CVE-2025-11234
HIGH 7.5

At a glance

Source
NVD
EPSS
EPSS 0.86 % · percentile 59 ()
State
PUBLISHED
Published
Updated
Assigner
redhat
NVD status
Deferred

Search on…

Description

A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication.

Weaknesses (CWE)

References

Scores

VersionScoreVectorScored by
CVSS 3.1HIGH 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hredhat
CVSS 3.1HIGH 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HNVD · secalert@redhat.com (Secondary)

European references

CERT-FR advisories

Affected products

ProductVersions
qemuaffected 2.6.0 < 10.1.2
Red Hat · Red Hat Enterprise Linux 10unaffected 18:10.0.0-14.el10_1.5 < *
Red Hat · Red Hat Enterprise Linux 8unaffected 8100020251120003312.489197e6 < *
Red Hat · Red Hat Enterprise Linux 8unaffected 8100020251202222937.489197e6 < *
Red Hat · Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Supportunaffected 8040020260916092751.522a0ee4 < *
Red Hat · Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-Onunaffected 8040020260916092751.522a0ee4 < *
Red Hat · Red Hat Enterprise Linux 8.8 Telecommunications Update Serviceunaffected 8080020260910092120.63b34585 < *
Red Hat · Red Hat Enterprise Linux 8.8 Update Services for SAP Solutionsunaffected 8080020260910092120.63b34585 < *
Red Hat · Red Hat Enterprise Linux 9unaffected 17:10.1.0-17.el9_8 < *
Red Hat · Red Hat Enterprise Linux 9.0 Update Services for SAP Solutionsunaffected 17:6.2.0-11.el9_0.10 < *
Red Hat · Red Hat Enterprise Linux 9.2 Update Services for SAP Solutionsunaffected 17:7.2.0-14.el9_2.24 < *
Red Hat · Red Hat Enterprise Linux 9.4 Extended Update Supportunaffected 17:8.2.0-11.el9_4.18 < *
Red Hat · Red Hat Enterprise Linux 9.4 Extended Update Supportunaffected 17:8.2.0-11.el9_4.19 < *
Red Hat · Red Hat OpenShift Container Platform 4.12unaffected 412.86.202608241157-0 < *
Red Hat · Red Hat OpenShift Container Platform 4.16unaffected 416.94.202601071926-0 < *
Red Hat · Red Hat OpenShift Container Platform 4.17unaffected 417.94.202601120213-0 < *
Red Hat · Red Hat OpenShift Container Platform 4.18unaffected 418.94.202601071817-0 < *
Red Hat · Red Hat Enterprise Linux 6
Red Hat · Red Hat Enterprise Linux 7
Red Hat · Red Hat Enterprise Linux 7

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD