CVE-2026-3195

Publication date 3 March 2026

Last updated 26 June 2026

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

7.4 · High

Score breakdown

Description

A flaw was found in QEMU. When reading input audio in the virtio-snd device input callback, the `virtio_snd_pcm_in_cb` function did not check whether the iov could fit the data buffer, potentially leading to a heap out-of-bounds write. This issue exists due to an incomplete fix for CVE-2024-7730.

Read the notes from the security team

Status

Package Ubuntu Release Status
qemu 26.04 LTS resolute
Vulnerable
25.10 questing
Fixed 1:10.1.0+ds-5ubuntu2.6
24.04 LTS noble
Fixed 1:8.2.2+ds-0ubuntu1.16
22.04 LTS jammy
Not affected
20.04 LTS focal
Not affected
18.04 LTS bionic
Not affected
16.04 LTS xenial
Not affected
14.04 LTS trusty
Not affected

Notes

mdeslaur

incomplete fix for CVE-2024-7730

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
qemu

Severity score breakdown

CVSS version: CVSS v3.0

Base score 7.4 · High

Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Related Ubuntu Security Notices (USN)

Other references

Access our resources on patching vulnerabilities